CVE-2025-39736: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39736 is a vulnerability in the Linux kernel's memory leak detection subsystem (kmemleak) discovered and disclosed on September 11, 2025. The issue involves a potential deadlock condition in the memory pool allocation functionality when netpoll is enabled (NVD).

The vulnerability occurs when calling prwarnonce() while holding kmemleaklock in mempoolalloc(), which can trigger a deadlock due to lock inversion with the netconsole subsystem. This happens because prwarnonce() may trigger netpoll, which leads to _allocskb() attempting to reacquire kmemleaklock. The deadlock path follows this sequence: mempoolalloc() -> rawspinlockirqsave(&kmemleaklock) -> prwarnonce() -> netconsole subsystem -> netpoll -> alloc_skb -> createobject -> rawspinlockirqsave(&kmemleak_lock) (NVD).

When netpoll is enabled, this vulnerability can cause system deadlocks, potentially affecting system availability and stability. The issue specifically impacts the kernel's memory leak detection functionality (NVD).

The fix involves setting a flag and moving the prwarnonce() call outside of the kmemleak_lock protected region. This prevents the lock inversion scenario that leads to the deadlock (NVD).