← Back to CVE Explorer

CVE-2025-39725

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list In shrink_folio_list(), the hwpoisoned folio may be large folio, which can't be handled by unmap_poisoned_folio(). For THP, try_to_unmap_one() must be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then retry. Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of pvmw.pte. Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a WARN_ON_ONCE due to the page isn't in swapcache. Since UCE is rare in real world, and race with reclaimation is more rare, just skipping the hwpoisoned large folio is enough. memory_failure() will handle it if the UCE is triggered again. This happens when memory reclaim for large folio races with memory_failure(), and will lead to kernel panic. The race is as follows: cpu0 cpu1 shrink_folio_list memory_failure TestSetPageHWPoison unmap_poisoned_folio --> trigger BUG_ON due to unmap_poisoned_folio couldn't handle large folio [[email protected]: add comment to unmap_poisoned_folio()]

Severity
MEDIUM
CVSS score
5.5 (v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-05 18:15:50.320000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2025-39725",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-09-05T18:15:50.320",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list\n\nIn shrink_folio_list(), the hwpoisoned folio may be large folio, which\ncan't be handled by unmap_poisoned_folio().  For THP, try_to_unmap_one()\nmust be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then\nretry.  Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of\npvmw.pte.  Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a\nWARN_ON_ONCE due to the page isn't in swapcache.\n\nSince UCE is rare in real world, and race with reclaimation is more rare,\njust skipping the hwpoisoned large folio is enough.  memory_failure() will\nhandle it if the UCE is triggered again.\n\nThis happens when memory reclaim for large folio races with\nmemory_failure(), and will lead to kernel panic.  The race is as\nfollows:\n\ncpu0      cpu1\n shrink_folio_list memory_failure\n  TestSetPageHWPoison\n  unmap_poisoned_folio\n  --> trigger BUG_ON due to\n  unmap_poisoned_folio couldn't\n   handle large folio\n\n[[email protected]: add comment to unmap_poisoned_folio()]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/vmscan: corregir el manejo de folios grandes 'hwpoisoned' en shrink_folio_list\n\nEn shrink_folio_list(), el folio 'hwpoisoned' puede ser un folio grande, que no puede ser manejado por unmap_poisoned_folio(). Para THP, try_to_unmap_one() debe ser pasado con TTU_SPLIT_HUGE_PMD para dividir el PMD enorme primero y luego reintentar. Sin TTU_SPLIT_HUGE_PMD, activaremos una desreferencia de puntero nulo de pvmw.pte. Incluso si pasamos TTU_SPLIT_HUGE_PMD, activaremos un WARN_ON_ONCE debido a que la página no está en la swapcache.\n\nDado que UCE es raro en el mundo real, y la condición de carrera con la reclamación es aún más rara, simplemente omitir el folio grande 'hwpoisoned' es suficiente. memory_failure() lo manejará si el UCE se activa de nuevo.\n\nEsto ocurre cuando la reclamación de memoria para un folio grande entra en condición de carrera con memory_failure(), y conducirá a un pánico del kernel. La condición de carrera es la siguiente:\n\ncpu0      cpu1\n shrink_folio_list memory_failure\n  TestSetPageHWPoison\n  unmap_poisoned_folio\n  --> activa BUG_ON debido a\n  unmap_poisoned_folio no pudo\n   manejar folios grandes\n\n[[email protected]: añadir comentario a unmap_poisoned_folio()]"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "mm/memory-failure.c",
            "mm/vmscan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "1c9798bf8145a92abf45aa9d38a6406d9eb8bdf0",
              "lessThan": "656eaddbc952e1baae2f69281c22debe22140312",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1b0449544c6482179ac84530b61fc192a6527bfd",
              "lessThan": "c1101113d45838a823188ae25c61af97552a28ae",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1b0449544c6482179ac84530b61fc192a6527bfd",
              "lessThan": "9f1e8cd0b7c4c944e9921b52a6661b5eda2705ab",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "912e9f0300c3564b72a8808db406e313193a37ad",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6.12.26",
              "lessThan": "6.12.41",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.14.5",
              "lessThan": "6.15",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "mm/memory-failure.c",
            "mm/vmscan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.15",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.15",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.41",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.15.9",
              "lessThanOrEqual": "6.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.12.26",
              "versionEndExcluding": "6.12.41",
              "matchCriteriaId": "19B129C6-1ABE-4712-8AB0-009FB92F8F2B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.14.5",
              "versionEndExcluding": "6.15.9",
              "matchCriteriaId": "E63E673B-291A-456D-A515-12B29693073E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "7A9C2DE5-43B8-4D73-BDB5-EA55C7671A52"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/656eaddbc952e1baae2f69281c22debe22140312",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/9f1e8cd0b7c4c944e9921b52a6661b5eda2705ab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/c1101113d45838a823188ae25c61af97552a28ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}