CVE-2025-39736None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock.
This is the path for the deadlock.
mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags);
Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.
Linux >= c5665868183fec689dbab9fb8505188b2c4f0757 < c7b6ea0ede687e7460e593c5ea478f50aa41682aLinux >= c5665868183fec689dbab9fb8505188b2c4f0757 < 4b0151e1d468eb2667c37b7af99b3c075072d334Linux >= c5665868183fec689dbab9fb8505188b2c4f0757 < f249d32bb54876b4b6c3ae071af8ddca77af390bLinux >= c5665868183fec689dbab9fb8505188b2c4f0757 < 62879faa8efe8d8a9c7bf7606ee9c068012d7dacLinux >= c5665868183fec689dbab9fb8505188b2c4f0757 < 1da95d3d4b7b1d380ebd87b71a61e7e6aed3265dLinux >= c5665868183fec689dbab9fb8505188b2c4f0757 < a0854de00ce2ee27edf39037e7836ad580eb3350Linux >= c5665868183fec689dbab9fb8505188b2c4f0757 < 08f70be5e406ce47c822f2dd11c1170ca259605bLinux >= c5665868183fec689dbab9fb8505188b2c4f0757 < a181b228b37a6a5625dad2bb4265bb7abb673e9fLinux >= c5665868183fec689dbab9fb8505188b2c4f0757 < 47b0f6d8f0d2be4d311a49e13d2fd5f152f492b2Linux 5.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses