{"id":"CVE-2025-38383","summary":"mm/vmalloc: fix data race in show_numa_info()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix data race in show_numa_info()\n\nThe following data-race was found in show_numa_info():\n\n==================================================================\nBUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show\n\nread to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0:\n show_numa_info mm/vmalloc.c:4936 [inline]\n vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016\n seq_read_iter+0x373/0xb40 fs/seq_file.c:230\n proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299\n....\n\nwrite to 0xffff88800971fe30 of 4 bytes by task 8287 on cpu 1:\n show_numa_info mm/vmalloc.c:4934 [inline]\n vmalloc_info_show+0x38f/0x7e0 mm/vmalloc.c:5016\n seq_read_iter+0x373/0xb40 fs/seq_file.c:230\n proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299\n....\n\nvalue changed: 0x0000008f -\u003e 0x00000000\n==================================================================\n\nAccording to this report,there is a read/write data-race because\nm-\u003eprivate is accessible to multiple CPUs.  To fix this, instead of\nallocating the heap in proc_vmalloc_init() and passing the heap address to\nm-\u003eprivate, vmalloc_info_show() should allocate the heap.","modified":"2026-04-02T12:47:57.229955Z","published":"2025-07-25T12:53:24.578Z","related":["ALSA-2026:1178","SUSE-SU-2025:21074-1","SUSE-SU-2025:21139-1","SUSE-SU-2025:21179-1","openSUSE-SU-2025:20081-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38383.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5c5f0468d172ddec2e333d738d2a1f85402cf0bc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5c966f447a584ece3c70395898231aeb56256ee7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ead91de35d9cd5c4f80ec51e6020f342079170af"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38383.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38383"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8e1d743f2c2671aa54f6f91a2b33823f92512870"},{"fixed":"ead91de35d9cd5c4f80ec51e6020f342079170af"},{"fixed":"5c966f447a584ece3c70395898231aeb56256ee7"},{"fixed":"5c5f0468d172ddec2e333d738d2a1f85402cf0bc"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38383.json"}}],"schema_version":"1.7.5"}