---
id: CVE-2025-39910
title: 'mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()

  kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and
  always allocate memory usi…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 451769ebb7e792c3404db53b3c2a422990de654e <
    c136f2e4f2edd58a62a3425d4dd373d82834d1f9
  - >-
    Linux >= 451769ebb7e792c3404db53b3c2a422990de654e <
    9598c83a50a5f9d57fd0c12fc08d9425c1ce9537
  - >-
    Linux >= 451769ebb7e792c3404db53b3c2a422990de654e <
    aa1b4b7a1b92743297f9da741424df4703a8e11b
  - >-
    Linux >= 451769ebb7e792c3404db53b3c2a422990de654e <
    33b95d90427cb4babf32059e323a6d0c027610fe
  - >-
    Linux >= 451769ebb7e792c3404db53b3c2a422990de654e <
    79357cd06d41d0f5a11b17d7c86176e395d10ef2
  - Linux 5.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-01-14T17:42:43.252504Z'
published: '2025-10-01'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:22:36.341Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39910'
references:
  - url: 'https://git.kernel.org/stable/c/c136f2e4f2edd58a62a3425d4dd373d82834d1f9'
  - url: 'https://git.kernel.org/stable/c/9598c83a50a5f9d57fd0c12fc08d9425c1ce9537'
  - url: 'https://git.kernel.org/stable/c/aa1b4b7a1b92743297f9da741424df4703a8e11b'
  - url: 'https://git.kernel.org/stable/c/33b95d90427cb4babf32059e323a6d0c027610fe'
  - url: 'https://git.kernel.org/stable/c/79357cd06d41d0f5a11b17d7c86176e395d10ef2'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.04043
ingestedAt: '2026-10-21T12:48:53.687Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()

kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and
always allocate memory using the hardcoded GFP_KERNEL flag.  This makes
them inconsistent with vmalloc(), which was recently extended to support
GFP_NOFS and GFP_NOIO allocations.

Page table allocations performed during shadow population also ignore the
external gfp_mask.  To preserve the intended semantics of GFP_NOFS and
GFP_NOIO, wrap the apply_to_page_range() calls into the appropriate
memalloc scope.

xfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock.

There was a report here
https://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com

This patch:
 - Extends kasan_populate_vmalloc() and helpers to take gfp_mask;
 - Passes gfp_mask down to alloc_pages_bulk() and __get_free_page();
 - Enforces GFP_NOFS/NOIO semantics with memalloc_*_save()/restore()
   around apply_to_page_range();
 - Updates vmalloc.c and percpu allocator call sites accordingly.

## Affected

- `Linux >= 451769ebb7e792c3404db53b3c2a422990de654e < c136f2e4f2edd58a62a3425d4dd373d82834d1f9`
- `Linux >= 451769ebb7e792c3404db53b3c2a422990de654e < 9598c83a50a5f9d57fd0c12fc08d9425c1ce9537`
- `Linux >= 451769ebb7e792c3404db53b3c2a422990de654e < aa1b4b7a1b92743297f9da741424df4703a8e11b`
- `Linux >= 451769ebb7e792c3404db53b3c2a422990de654e < 33b95d90427cb4babf32059e323a6d0c027610fe`
- `Linux >= 451769ebb7e792c3404db53b3c2a422990de654e < 79357cd06d41d0f5a11b17d7c86176e395d10ef2`
- `Linux 5.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.