CVE-2025-38029: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38029 is a Linux kernel vulnerability in the Kernel Address SANitizer (KASAN) subsystem that causes a kernel panic by triggering a sleepable page allocation from an atomic (non-sleeping) context. The flaw affects Linux kernel versions from 5.5 up to (but not including) 6.14.9, as well as 6.15 release candidates (rc1 through rc7). It was published on June 18, 2025, and patches were added to the stable kernel repositories. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local, low-privilege attack vector with high availability impact (Feedly).

The root cause is classified under CWE-sleep-in-atomic-context: apply_to_pte_range() enters lazy MMU mode (which on s390 disables preemption via arch_enter_lazy_mmu_mode()) and then invokes the kasan_populate_vmalloc_pte() callback on each page table walk iteration. This callback may attempt to allocate a single page, which can sleep — an operation forbidden in an atomic/preemption-disabled context. The crash manifests as a "BUG: sleeping function called from invalid context" kernel panic, as observed on s390 architecture with KVM. The fix addresses this by bulk-allocating shadow memory before entering the KASAN population callbacks, avoiding any sleep within the atomic section (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability results in a kernel panic, causing an immediate system crash and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running affected kernel versions on s390 architecture (particularly under KVM) are most directly at risk, though the underlying code path exists across other architectures as well (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.018%, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the practical attack surface (Feedly).

The primary remediation is to update the Linux kernel to version 6.14.9 or later, which includes the fix. Patches are available in the official Linux stable kernel repositories (commits 6748dd09196248b985cca39eaf651d5317271977 and b6ea95a34cbd014ab6ade4248107b86b0aaf2d6c). Ubuntu has issued security notices (USN-7771-1 for OEM kernels and USN-7789-2 for Raspberry Pi kernels) addressing this CVE. Organizations unable to immediately upgrade should monitor system logs for kernel panic messages related to apply_to_pte_range and KASAN vmalloc population (Feedly, Ubuntu USN-7771-1, Ubuntu USN-7789-2).

The vulnerability received routine coverage from Linux security tracking resources including Debian's security tracker, Ubuntu security notices, and Yocto Project security mailing lists. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries (Feedly).