CVE-2025-39910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()

kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and

always allocate memory using the hardcoded GFP_KERNEL flag. This makes

them inconsistent with vmalloc(), which was recently extended to support

GFP_NOFS and GFP_NOIO allocations.

Page table allocations performed during shadow population also ignore the

external gfp_mask. To preserve the intended semantics of GFP_NOFS and

GFP_NOIO, wrap the apply_to_page_range() calls into the appropriate

memalloc scope.

xfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock.

There was a report here

https://lkml.kernel.org/r/[email protected]

This patch:

- Extends kasan_populate_vmalloc() and helpers to take gfp_mask;

- Passes gfp_mask down to alloc_pages_bulk() and __get_free_page();

- Enforces GFP_NOFS/NOIO semantics with memalloc_*_save()/restor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References