medium 5.5

CVE-2025-39843 json

mm: slub: avoid wake up kswapd in set_track_prepare

published 2025-09-19 13 mo ago modified 2026-10-19 20 d ago also EUVD-2025-30357

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock.

Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there.

The oops looks something like:

BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...

Patch / fix

fixed in 2 distros 5 links 5

Linux Linux 6.1.151, 6.6.105, 6.12.46, 6.16.6, 6.17
Siemens SIMATIC CN 4100 V5.0

debian ubuntu red hat almalinux rocky linux

linux Debian 12 6.1.153-1
linux Debian 13 6.12.48-1
linux Debian 14 6.16.6-1

debian advisories DEBIAN-CVE-2025-39843

linux Ubuntu 24.04 LTS 6.8.0-106.106
linux-aws Ubuntu 24.04 LTS 6.8.0-1050.53
linux-gcp Ubuntu 24.04 LTS 6.8.0-1052.55
linux-gke Ubuntu 24.04 LTS 6.8.0-1048.53
linux-ibm Ubuntu 24.04 LTS 6.8.0-1049.49
linux-azure Ubuntu 24.04 LTS 6.8.0-1051.57
linux-gkeop Ubuntu 24.04 LTS 6.8.0-1035.38
linux-raspi Ubuntu 24.04 LTS 6.8.0-1050.54

ubuntu advisories UBUNTU-CVE-2025-39843

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 10.1 6.12.0-124.27.1.el10_1
rv RHEL 10.1 6.12.0-124.27.1.el10_1
perf RHEL 10.1 6.12.0-124.27.1.el10_1
rtla RHEL 10.1 6.12.0-124.27.1.el10_1
libperf RHEL 10.1 6.12.0-124.27.1.el10_1
kernel-rt RHEL 10.1 6.12.0-124.27.1.el10_1
kernel-64k RHEL 10.1 6.12.0-124.27.1.el10_1
kernel-core RHEL 10.1 6.12.0-124.27.1.el10_1

red hat advisories RHSA-2026:0453 RHSA-2026:0271 RHSA-2025:23789 RHSA-2025:21926

kernel-abi-stablelists AlmaLinux 10 6.12.0-124.27.1.el10_1
kernel AlmaLinux 9 5.14.0-611.9.1.el9_7
rv AlmaLinux 9 5.14.0-611.9.1.el9_7
perf AlmaLinux 9 5.14.0-611.9.1.el9_7
rtla AlmaLinux 9 5.14.0-611.9.1.el9_7
kernel-64k AlmaLinux 9 5.14.0-611.9.1.el9_7
python3-perf AlmaLinux 9 5.14.0-611.9.1.el9_7
kernel-64k-core AlmaLinux 9 5.14.0-611.9.1.el9_7

almalinux advisories ALSA-2026:0453 ALSA-2025:21926

kernel Rocky Linux 10 6.12.0-124.27.1.el10_1
kernel Rocky Linux 9 5.14.0-611.9.1.el9_7

rocky linux advisories RLSA-2026:0453 RLSA-2025:21926

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-39843 updated 2026-11-05 cvss 4.7

kernel: mm: slub: avoid wake up kswapd in set_track_prepare

Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
affected: workaround, no fix planned “Will not fix”
Red Hat CodeReady Linux Builder EUS (v.9.6) libperf 5.14.0-570.76.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.76.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.76.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.76.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.76.1.el9_6
fixed: vendor fix RHSA-2025:23789
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-611.9.1.el9_7, perf 5.14.0-611.9.1.el9_7, rtla 5.14.0-611.9.1.el9_7, python3-perf 5.14.0-611.9.1.el9_7, kernel-devel-matched 5.14.0-611.9.1.el9_7, kernel-64k-devel-matched 5.14.0-611.9.1.el9_7, +7 more
fixed: vendor fix RHSA-2025:21926
Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-124.27.1.el10_1, perf 6.12.0-124.27.1.el10_1, rtla 6.12.0-124.27.1.el10_1, python3-perf 6.12.0-124.27.1.el10_1, kernel-devel-matched 6.12.0-124.27.1.el10_1, kernel-64k-devel-matched 6.12.0-124.27.1.el10_1, +7 more
fixed: vendor fix RHSA-2026:0453
Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-devel-matched 6.12.0-55.52.1.el10_0, kernel-64k-devel-matched 6.12.0-55.52.1.el10_0, kernel-debug-devel-matched 6.12.0-55.52.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.52.1.el10_0, kernel-zfcpdump-devel-matched 6.12.0-55.52.1.el10_0, kernel-64k-debug-devel-matched 6.12.0-55.52.1.el10_0, +3 more
fixed: vendor fix RHSA-2026:0271
Red Hat Enterprise Linux AppStream EUS (v.9.6) rv 5.14.0-570.76.1.el9_6, perf 5.14.0-570.76.1.el9_6, rtla 5.14.0-570.76.1.el9_6, python3-perf 5.14.0-570.76.1.el9_6, kernel-devel-matched 5.14.0-570.76.1.el9_6, kernel-64k-devel-matched 5.14.0-570.76.1.el9_6, +7 more
fixed: vendor fix RHSA-2025:23789
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-611.9.1.el9_7, kernel-64k 5.14.0-611.9.1.el9_7, kernel-core 5.14.0-611.9.1.el9_7, kernel-tools 5.14.0-611.9.1.el9_7, kernel-modules 5.14.0-611.9.1.el9_7, kernel-64k-core 5.14.0-611.9.1.el9_7, +27 more
fixed: vendor fix RHSA-2025:21926
Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-124.27.1.el10_1, kernel-64k 6.12.0-124.27.1.el10_1, kernel-core 6.12.0-124.27.1.el10_1, kernel-tools 6.12.0-124.27.1.el10_1, kernel-modules 6.12.0-124.27.1.el10_1, kernel-64k-core 6.12.0-124.27.1.el10_1, +28 more
fixed: vendor fix RHSA-2026:0453

show 14 more

Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.52.1.el10_0, kernel-64k 6.12.0-55.52.1.el10_0, kernel-core 6.12.0-55.52.1.el10_0, kernel-tools 6.12.0-55.52.1.el10_0, kernel-modules 6.12.0-55.52.1.el10_0, kernel-64k-core 6.12.0-55.52.1.el10_0, +27 more
fixed: vendor fix RHSA-2026:0271
Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel 5.14.0-570.76.1.el9_6, kernel-64k 5.14.0-570.76.1.el9_6, kernel-core 5.14.0-570.76.1.el9_6, kernel-tools 5.14.0-570.76.1.el9_6, kernel-modules 5.14.0-570.76.1.el9_6, kernel-64k-core 5.14.0-570.76.1.el9_6, +27 more
fixed: vendor fix RHSA-2025:23789
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-611.9.1.el9_7, kernel-debuginfo-common-s390x 5.14.0-611.9.1.el9_7, kernel-debuginfo-common-x86_64 5.14.0-611.9.1.el9_7, kernel-debuginfo-common-aarch64 5.14.0-611.9.1.el9_7, kernel-debuginfo-common-ppc64le 5.14.0-611.9.1.el9_7
fixed: vendor fix RHSA-2025:21926
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-124.27.1.el10_1, kernel-debuginfo-common-s390x 6.12.0-124.27.1.el10_1, kernel-debuginfo-common-x86_64 6.12.0-124.27.1.el10_1, kernel-debuginfo-common-aarch64 6.12.0-124.27.1.el10_1, kernel-debuginfo-common-ppc64le 6.12.0-124.27.1.el10_1
fixed: vendor fix RHSA-2026:0453
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-debuginfo-common-s390x 6.12.0-55.52.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.52.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.52.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.52.1.el10_0
fixed: vendor fix RHSA-2026:0271
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-611.9.1.el9_7, kernel-rt-64k 5.14.0-611.9.1.el9_7, kernel-rt-core 5.14.0-611.9.1.el9_7, kernel-rt-modules 5.14.0-611.9.1.el9_7, kernel-rt-64k-core 5.14.0-611.9.1.el9_7, kernel-rt-debug-core 5.14.0-611.9.1.el9_7, +14 more
fixed: vendor fix RHSA-2025:21926
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-124.27.1.el10_1, kernel-rt-64k 6.12.0-124.27.1.el10_1, kernel-rt-core 6.12.0-124.27.1.el10_1, kernel-rt-modules 6.12.0-124.27.1.el10_1, kernel-rt-64k-core 6.12.0-124.27.1.el10_1, kernel-rt-debug-core 6.12.0-124.27.1.el10_1, +14 more
fixed: vendor fix RHSA-2026:0453
Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.52.1.el10_0, kernel-rt-64k 6.12.0-55.52.1.el10_0, kernel-rt-core 6.12.0-55.52.1.el10_0, kernel-rt-modules 6.12.0-55.52.1.el10_0, kernel-rt-64k-core 6.12.0-55.52.1.el10_0, kernel-rt-debug-core 6.12.0-55.52.1.el10_0, +14 more
fixed: vendor fix RHSA-2026:0271
Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt 5.14.0-570.76.1.el9_6, kernel-rt-64k 5.14.0-570.76.1.el9_6, kernel-rt-core 5.14.0-570.76.1.el9_6, kernel-rt-modules 5.14.0-570.76.1.el9_6, kernel-rt-64k-core 5.14.0-570.76.1.el9_6, kernel-rt-debug-core 5.14.0-570.76.1.el9_6, +14 more
fixed: vendor fix RHSA-2025:23789
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-611.9.1.el9_7, kernel-rt-core 5.14.0-611.9.1.el9_7, kernel-rt-modules 5.14.0-611.9.1.el9_7, kernel-rt-debug-core 5.14.0-611.9.1.el9_7, kernel-rt-modules-core 5.14.0-611.9.1.el9_7, kernel-rt-debug-modules 5.14.0-611.9.1.el9_7, +4 more
fixed: vendor fix RHSA-2025:21926
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-124.27.1.el10_1, kernel-rt-core 6.12.0-124.27.1.el10_1, kernel-rt-modules 6.12.0-124.27.1.el10_1, kernel-rt-debug-core 6.12.0-124.27.1.el10_1, kernel-rt-modules-core 6.12.0-124.27.1.el10_1, kernel-rt-debug-modules 6.12.0-124.27.1.el10_1, +4 more
fixed: vendor fix RHSA-2026:0453
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.52.1.el10_0, kernel-rt-kvm 6.12.0-55.52.1.el10_0, kernel-rt-core 6.12.0-55.52.1.el10_0, kernel-rt-modules 6.12.0-55.52.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.52.1.el10_0, kernel-rt-debug-core 6.12.0-55.52.1.el10_0, +6 more
fixed: vendor fix RHSA-2026:0271
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt 5.14.0-570.76.1.el9_6, kernel-rt-kvm 5.14.0-570.76.1.el9_6, kernel-rt-core 5.14.0-570.76.1.el9_6, kernel-rt-modules 5.14.0-570.76.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.76.1.el9_6, kernel-rt-debug-core 5.14.0-570.76.1.el9_6, +6 more
fixed: vendor fix RHSA-2025:23789
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.52.1.el10_0, perf 6.12.0-55.52.1.el10_0, rtla 6.12.0-55.52.1.el10_0, python3-perf 6.12.0-55.52.1.el10_0 Red Hat Enterprise Linux BaseOS EUS (v. 10.0) perf-debuginfo 6.12.0-55.52.1.el10_0, libperf-debuginfo 6.12.0-55.52.1.el10_0, python3-perf-debuginfo 6.12.0-55.52.1.el10_0 Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.52.1.el10_0

+2 more productsfewer

Red Hat Enterprise Linux Real Time EUS (v. 10.0) perf-debuginfo 6.12.0-55.52.1.el10_0, libperf-debuginfo 6.12.0-55.52.1.el10_0, python3-perf-debuginfo 6.12.0-55.52.1.el10_0 Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) perf-debuginfo 6.12.0-55.52.1.el10_0, libperf-debuginfo 6.12.0-55.52.1.el10_0, python3-perf-debuginfo 6.12.0-55.52.1.el10_0

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-134-10 updated 2026-05-14 cvss 7.0

Siemens SIMATIC

Siemens SIMATIC CN 4100 < 5.0
affected: fixed in V5.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux
Siemens SIMATIC CN 4100

Classification

Weakness

CWE-667 Improper Locking

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2025-39843
NVD CVE-2025-39843

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary