{
  "cveId": "CVE-2025-38029",
  "url": "https://patchblox.com/security/cve/CVE-2025-38029",
  "summary": "CVE-2025-38029 is fixed in linux on 1 platform, first by DEBIAN-CVE-2025-38029, released June 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "kasan: avoid sleepable page allocation from atomic context",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  kasan: avoid sleepable page allocation from atomic context  apply_to_pte_range() enters the lazy MMU mode and then invokes kasan_populate_vmalloc_pte() callback on each page table walk iteration.  However, the callback can go into sleep when trying to allocate a single page, e.g.  if an architecutre disables preemption on lazy MMU mode enter.  On s390 if make arch_enter_lazy_mmu_mode() -\u003E preempt_enable() and arch_leave_lazy_mmu_mode() -\u003E preempt_disable(), such crash occurs:  [    0.663336] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321 [    0.663348] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd [    0.663358] preempt_count: 1, expected: 0 [    0.663366] RCU nest depth: 0, expected: 0 [    0.663375] no locks held by kthreadd/2. [    0.663383] Preemption disabled at: [    0.663386] [\u003C0002f3284cbb4eda\u003E] apply_to_pte_range\u002B0xfa/0x4a0 [    0.663405] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.15.0-rc5-gcc-kasan-00043-gd76bb1ebb558-dirty #162 PREEMPT [    0.663408] Hardware name: IBM 3931 A01 701 (KVM/Linux) [    0.663409] Call Trace: [    0.663410]  [\u003C0002f3284c385f58\u003E] dump_stack_lvl\u002B0xe8/0x140 [    0.663413]  [\u003C0002f3284c507b9e\u003E] __might_resched\u002B0x66e/0x700 [    0.663415]  [\u003C0002f3284cc4f6c0\u003E] __alloc_frozen_pages_noprof\u002B0x370/0x4b0 [    0.663419]  [\u003C0002f3284ccc73c0\u003E] alloc_pages_mpol\u002B0x1a0/0x4a0 [    0.663421]  [\u003C0002f3284ccc8518\u003E] alloc_frozen_pages_noprof\u002B0x88/0xc0 [    0.663424]  [\u003C0002f3284ccc8572\u003E] alloc_pages_noprof\u002B0x22/0x120 [    0.663427]  [\u003C0002f3284cc341ac\u003E] get_free_pages_noprof\u002B0x2c/0xc0 [    0.663429]  [\u003C0002f3284cceba70\u003E] kasan_populate_vmalloc_pte\u002B0x50/0x120 [    0.663433]  [\u003C0002f3284cbb4ef8\u003E] apply_to_pte_range\u002B0x118/0x4a0 [    0.663435]  [\u003C0002f3284cbc7c14\u003E] apply_to_pmd_range\u002B0x194/0x3e0 [    0.663437]  [\u003C0002f3284cbc99be\u003E] __apply_to_page_range\u002B0x2fe/0x7a0 [    0.663440]  [\u003C0002f3284cbc9e88\u003E] apply_to_page_range\u002B0x28/0x40 [    0.663442]  [\u003C0002f3284ccebf12\u003E] kasan_populate_vmalloc\u002B0x82/0xa0 [    0.663445]  [\u003C0002f3284cc1578c\u003E] alloc_vmap_area\u002B0x34c/0xc10 [    0.663448]  [\u003C0002f3284cc1c2a6\u003E] __get_vm_area_node\u002B0x186/0x2a0 [    0.663451]  [\u003C0002f3284cc1e696\u003E] __vmalloc_node_range_noprof\u002B0x116/0x310 [    0.663454]  [\u003C0002f3284cc1d950\u003E] __vmalloc_node_noprof\u002B0xd0/0x110 [    0.663457]  [\u003C0002f3284c454b88\u003E] alloc_thread_stack_node\u002B0xf8/0x330 [    0.663460]  [\u003C0002f3284c458d56\u003E] dup_task_struct\u002B0x66/0x4d0 [    0.663463]  [\u003C0002f3284c45be90\u003E] copy_process\u002B0x280/0x4b90 [    0.663465]  [\u003C0002f3284c460940\u003E] kernel_clone\u002B0xd0/0x4b0 [    0.663467]  [\u003C0002f3284c46115e\u003E] kernel_thread\u002B0xbe/0xe0 [    0.663469]  [\u003C0002f3284c4e440e\u003E] kthreadd\u002B0x50e/0x7f0 [    0.663472]  [\u003C0002f3284c38c04a\u003E] __ret_from_fork\u002B0x8a/0xf0 [    0.663475]  [\u003C0002f3284ed57ff2\u003E] ret_from_fork\u002B0xa/0x38  Instead of allocating single pages per-PTE, bulk-allocate the shadow memory prior to applying kasan_populate_vmalloc_pte() callback on a page range.",
  "published": "2025-06-18T10:15:34Z",
  "severity": "Low",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00237,
  "epssPercentile": 0.14788,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38029",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2025-38029",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38029",
      "released": "2025-06-18T10:15:34Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.16.3-1",
      "fix": "DEBIAN-CVE-2025-38029",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38029",
      "released": "2025-06-18T10:15:34Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}