CVE-2025-39843

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: slub: avoid wake up kswapd in set_track_prepare

set_track_prepare() can incur lock recursion.

The issue is that it is called from hrtimer_start_range_ns

holding the per_cpu(hrtimer_bases)[n].lock, but when enabled

CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare,

and try to hold the per_cpu(hrtimer_bases)[n].lock.

Avoid deadlock caused by implicitly waking up kswapd by passing in

allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the

debug_objects_fill_pool() case. Inside stack depot they are processed by

gfp_nested_mask().

Since ___slab_alloc() has preemption disabled, we mask out

__GFP_DIRECT_RECLAIM from the flags there.

The oops looks something like:

BUG: spinlock recursion on CPU#3, swapper/3/0

lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3

Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT)

Call trace:

spin_bug+0x0

_raw

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References