CVE-2025-39736: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
Vulnerability summary
CVE-2025-39736 is a medium (CVSS 5.5) Improper Locking vulnerability in debian debian_linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.8% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 28 · Related 25Timeline
- 11-09-2025PublishedVulnerability first disclosed.
- 12-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.13% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu144 products
- linuxAll versions (No fix recorded) | < 5.15.0-163.173 | < 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1097.104 | < 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.153-1 | < 6.12.43-1 | < 6.16.3-1
- debian_linuxEOL11.0
Linux2 products
- linux≥ c5665868183fec689dbab9fb8505188b2c4f0757, < c7b6ea0ede687e7460e593c5ea478f50aa41682a | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < 4b0151e1d468eb2667c37b7af99b3c075072d334 | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < f249d32bb54876b4b6c3ae071af8ddca77af390b | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < 62879faa8efe8d8a9c7bf7606ee9c068012d7dac | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < 1da95d3d4b7b1d380ebd87b71a61e7e6aed3265d | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < a0854de00ce2ee27edf39037e7836ad580eb3350 | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < 08f70be5e406ce47c822f2dd11c1170ca259605b | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < a181b228b37a6a5625dad2bb4265bb7abb673e9f | ≥ c5665868183fec689dbab9fb8505188b2c4f0757, < 47b0f6d8f0d2be4d311a49e13d2fd5f152f492b2 | 5.4
- linux_kernel≥ 5.4, < 5.4.297 | ≥ 5.5, < 5.10.241 | ≥ 5.11, < 5.15.190 | ≥ 5.16, < 6.1.149 | ≥ 6.2, < 6.6.103 | ≥ 6.7, < 6.12.43 | ≥ 6.13, < 6.15.11 | ≥ 6.16, < 6.16.2 | 6.17:rc1
3 vendors · 148 products
