CVE-2025-38029: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-38029) was discovered in the Linux kernel where apply_to_pte_range() enters the lazy MMU mode and invokes kasan_populate_vmalloc_pte() callback on each page table walk iteration. The issue was disclosed on June 18, 2025, and affects the Linux kernel's memory management subsystem (NVD, Wiz).

The vulnerability occurs when the callback attempts to allocate a single page while in sleep mode, particularly if an architecture disables preemption on lazy MMU mode enter. This specifically affects s390 architecture when arch_enter_lazy_mmu_mode() enables preemption and arch_leave_lazy_mmu_mode() disables it, leading to a crash in the kernel. The issue manifests as a 'sleeping function called from invalid context' error, occurring in an atomic context (NVD).

When triggered, this vulnerability causes a kernel crash, resulting in system instability. The issue specifically affects the kernel's memory management functionality, potentially leading to system crashes during memory operations (Wiz).

The fix involves bulk-allocating the shadow memory prior to applying kasan_populate_vmalloc_pte() callback on a page range, instead of allocating single pages per-PTE. This prevents the sleep state conflict in atomic context (NVD).