CVE-2025-39843: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39843 is a vulnerability discovered in the Linux kernel related to a lock recursion issue in the memory management subsystem. The vulnerability was disclosed on September 19, 2025, affecting the Linux kernel's SLUB allocator functionality (NVD).

The vulnerability occurs in the set_track_prepare() function of the Linux kernel's SLUB memory allocator. When CONFIG_DEBUG_OBJECTS_TIMERS is enabled, set_track_prepare() can trigger lock recursion while holding the per_cpu(hrtimer_bases)[n].lock. The issue arises when the function attempts to wake up kswapd while already holding this lock, potentially leading to a deadlock condition (NVD).

The vulnerability can result in a kernel deadlock condition, potentially causing system hangs or denial of service. This occurs specifically when the system attempts to perform certain memory allocation operations while debugging timers is enabled (NVD).

The issue has been addressed in the Linux kernel by modifying the allocation flags to avoid waking up kswapd in set_track_prepare. For the Debian stable distribution (trixie), this vulnerability has been fixed in version 6.12.48-1 (Debian Security).