In the Linux kernel, the following vulnerability has been resolved: kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock); <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report(); print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area(); spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove kasan_find_vm_area().

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't be called in     atomic_context. If find_vm_area() is called to reports vm area information, kasan can trigger deadlock     like: CPU0 CPU1 vmalloc(); alloc_vmap_area(); spin_lock(&vn->busy.lock) spin_lock_bh(&some_lock);
    <interrupt occurs> <in softirq> spin_lock(&some_lock); <access invalid address> kasan_report();
    print_report(); print_address_description(); kasan_find_vm_area(); find_vm_area();
    spin_lock(&vn->busy.lock) // deadlock! To prevent possible deadlock while kasan reports, remove     kasan_find_vm_area(). (CVE-2025-38510)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

CVE-2025-38510

medium

Tenable Plugins

critical