CVE-2025-39737

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup.

• CWE-401

• https://git.kernel.org/stable/c/1ef72a7fedc5bca70e8cc980985790de10d407aaPatch
• https://git.kernel.org/stable/c/8d2d22a55ffe35c38e69795468a7addd1a80e9cePatch
• https://git.kernel.org/stable/c/926092268efdf1ed7b55cf486356c74a9e7710d1Patch
• https://git.kernel.org/stable/c/9b80430c194e4a114dc663c1025d56b4f3d0153dPatch
• https://git.kernel.org/stable/c/9f1f4e95031f84867c5821540466d62f88dab8caPatch
• https://git.kernel.org/stable/c/a04de4c40aab9b338dfa989cf4aec70fd187eeb2Patch
• https://git.kernel.org/stable/c/d1534ae23c2b6be350c8ab060803fbf6e9682adcPatch
• https://git.kernel.org/stable/c/e21a3ddd58733ce31afcb1e5dc3cb80a4b5bc29bPatch
• https://git.kernel.org/stable/c/f014c10d190b92aad366e56b445daffcd1c075e4Patch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlMailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Published

Sep 11, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-39731In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-39732In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-39733In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-39734In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-39735In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2025-39736In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-39738In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-39739In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-3974A vulnerability has been found in PHPGurukul COVID19 Testing…9.8
• CVE-2025-39740In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-39741In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-39742In the Linux kernel, the following vulnerability has been re…5.5