{"id":"DEBIAN-CVE-2025-38383","details":"In the Linux kernel, the following vulnerability has been resolved:  mm/vmalloc: fix data race in show_numa_info()  The following data-race was found in show_numa_info():  ================================================================== BUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show  read to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0:  show_numa_info mm/vmalloc.c:4936 [inline]  vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016  seq_read_iter+0x373/0xb40 fs/seq_file.c:230  proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 ....  write to 0xffff88800971fe30 of 4 bytes by task 8287 on cpu 1:  show_numa_info mm/vmalloc.c:4934 [inline]  vmalloc_info_show+0x38f/0x7e0 mm/vmalloc.c:5016  seq_read_iter+0x373/0xb40 fs/seq_file.c:230  proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 ....  value changed: 0x0000008f -\u003e 0x00000000 ==================================================================  According to this report,there is a read/write data-race because m-\u003eprivate is accessible to multiple CPUs.  To fix this, instead of allocating the heap in proc_vmalloc_init() and passing the heap address to m-\u003eprivate, vmalloc_info_show() should allocate the heap.","modified":"2026-08-27T23:05:21.855903042Z","published":"2025-07-25T13:15:27.520Z","upstream":["CVE-2025-38383"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38383"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38383.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38383.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}