{"id":"DEBIAN-CVE-2025-38008","details":"In the Linux kernel, the following vulnerability has been resolved:  mm/page_alloc: fix race condition in unaccepted memory handling  The page allocator tracks the number of zones that have unaccepted memory using static_branch_enc/dec() and uses that static branch in hot paths to determine if it needs to deal with unaccepted memory.  Borislav and Thomas pointed out that the tracking is racy: operations on static_branch are not serialized against adding/removing unaccepted pages to/from the zone.  Sanity checks inside static_branch machinery detects it:  WARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0  The comment around the WARN() explains the problem:  \t/* \t * Warn about the '-1' case though; since that means a \t * decrement is concurrent with a first (0-\u003e1) increment. IOW \t * people are trying to disable something that wasn't yet fully \t * enabled. This suggests an ordering problem on the user side. \t */  The effect of this static_branch optimization is only visible on microbenchmark.  Instead of adding more complexity around it, remove it altogether.","modified":"2026-08-27T23:05:29.069693299Z","published":"2025-06-18T10:15:32.037Z","upstream":["CVE-2025-38008"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38008"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.30-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38008.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.30-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38008.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}