VulnerabilityPublished 11 Sep 2025Updated 5 Nov 2026

CVE-2025-39737: Linux kernel · mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f014c10d190b92aad366e56b445daffcd1c075e4 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:48 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in f014c10d190b92aad366e56b445daffcd1c075e4, e21a3ddd58733ce31afcb1e5dc3cb80a4b5bc29b, d1534ae23c2b6be350c8ab060803fbf6e9682adc +6

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2abd839aa7e615f2bbc50c8ba7deb9e40d186768, < f014c10d190b92aad366e56b445daffcd1c075e4	Fixed in f014c10d190b92aad366e56b445daffcd1c075e4
LinuxLinux	Affected ≥ 2abd839aa7e615f2bbc50c8ba7deb9e40d186768, < e21a3ddd58733ce31afcb1e5dc3cb80a4b5bc29b	Fixed in e21a3ddd58733ce31afcb1e5dc3cb80a4b5bc29b
LinuxLinux	Affected ≥ 2abd839aa7e615f2bbc50c8ba7deb9e40d186768, < d1534ae23c2b6be350c8ab060803fbf6e9682adc	Fixed in d1534ae23c2b6be350c8ab060803fbf6e9682adc
LinuxLinux	Affected ≥ 2abd839aa7e615f2bbc50c8ba7deb9e40d186768, < a04de4c40aab9b338dfa989cf4aec70fd187eeb2	Fixed in a04de4c40aab9b338dfa989cf4aec70fd187eeb2
LinuxLinux	Affected ≥ 2abd839aa7e615f2bbc50c8ba7deb9e40d186768, < 926092268efdf1ed7b55cf486356c74a9e7710d1	Fixed in 926092268efdf1ed7b55cf486356c74a9e7710d1
LinuxLinux	Affected ≥ 2abd839aa7e615f2bbc50c8ba7deb9e40d186768, < 9f1f4e95031f84867c5821540466d62f88dab8ca	Fixed in 9f1f4e95031f84867c5821540466d62f88dab8ca

AI-suggested

A fix has been implemented and is available in the Linux kernel source as indicated by the fixed commit versions. Users running debug kernels with kmemleak enabled should update to a kernel version that includes these fixes. No additional mitigation is required as the patch addresses the root cause by enabling periodic rescheduling during cleanup.

Description

A soft lockup vulnerability was identified in the Linux kernel's kmemleak subsystem during cleanup operations. The issue occurs when kmemleak attempts to delete a large number of objects in a debug kernel environment, potentially causing the CPU to be stuck for an extended period. The vulnerability has been addressed by introducing periodic rescheduling calls to prevent the soft lockup during the cleanup loop.

Impact

The vulnerability can cause a soft lockup warning, where a CPU core becomes unresponsive for an extended period (e.g., 33 seconds), potentially affecting system responsiveness and stability during kmemleak cleanup operations in debug kernels. It does not indicate a security breach or data compromise but impacts system reliability under specific debug conditions.

Summary

CVE-2025-39737 describes a soft lockup condition in the Linux kernel's memory leak detector (kmemleak) during the __kmemleak_do_cleanup() function. On systems running a debug kernel with kmemleak enabled and a large memory pool size (e.g., 40,000 objects), the cleanup process can cause the CPU to be stuck due to the time taken to delete objects one-by-one while acquiring and releasing a raw_spinlock. The fix involves calling cond_resched() periodically within the cleanup loop to yield the CPU and avoid the soft lockup. This issue was observed on an x86-64 system with 16 GB of memory under workloads involving hot unplug events.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 21:48 UTC

Technical details

References

Community reviews

Related threats