CVE-2025-40199

{
  "id": "CVE-2025-40199",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-11-12T22:15:47.043",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches\n\nHelge reported that the introduction of PP_MAGIC_MASK let to crashes on\nboot on his 32-bit parisc machine. The cause of this is the mask is set\ntoo wide, so the page_pool_page_is_pp() incurs false positives which\ncrashes the machine.\n\nJust disabling the check in page_pool_is_pp() will lead to the page_pool\ncode itself malfunctioning; so instead of doing this, this patch changes\nthe define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel\npointers for page_pool-tagged pages.\n\nThe fix relies on the kernel pointers that alias with the pp_magic field\nalways being above PAGE_OFFSET. With this assumption, we can use the\nlowest bit of the value of PAGE_OFFSET as the upper bound of the\nPP_DMA_INDEX_MASK, which should avoid the false positives.\n\nBecause we cannot rely on PAGE_OFFSET always being a compile-time\nconstant, nor on it always being >0, we fall back to disabling the\ndma_index storage when there are not enough bits available. This leaves\nus in the situation we were in before the patch in the Fixes tag, but\nonly on a subset of architecture configurations. This seems to be the\nbest we can do until the transition to page types in complete for\npage_pool pages.\n\nv2:\n- Make sure there's at least 8 bits available and that the PAGE_OFFSET\n  bit calculation doesn't wrap"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npage_pool: Corrección de PP_MAGIC_MASK para evitar fallos en algunas arquitecturas de 32 bits\n\nHelge informó que la introducción de PP_MAGIC_MASK provocó fallos durante el arranque en su máquina parisc de 32 bits. La causa de esto es que la máscara está configurada demasiado amplia, por lo que page_pool_page_is_pp() incurre en falsos positivos, lo que provoca el fallo de la máquina.\n\nSimplemente deshabilitar la comprobación en page_pool_is_pp() haría que el propio código de page_pool funcionara mal; así que, en lugar de hacer esto, este parche cambia la definición de PP_DMA_INDEX_BITS para evitar confundir punteros arbitrarios del kernel con páginas etiquetadas como page_pool.\n\nLa solución se basa en que los punteros del kernel que se superponen con el campo pp_magic siempre estén por encima de PAGE_OFFSET. Con esta suposición, podemos usar el bit más bajo del valor de PAGE_OFFSET como límite superior de PP_DMA_INDEX_MASK, lo que debería evitar los falsos positivos.\n\nDado que no podemos confiar en que PAGE_OFFSET sea siempre una constante en tiempo de compilación, ni en que siempre sea >0, recurrimos a deshabilitar el almacenamiento de dma_index cuando no hay suficientes bits disponibles. Esto nos deja en la situación en la que estábamos antes del parche en la etiqueta Fixes, pero solo en un subconjunto de configuraciones de arquitectura. Esto parece ser lo mejor que podemos hacer hasta que la transición a los tipos de página esté completa para las páginas de page_pool.\n\nv2:\n- Asegurarse de que haya al menos 8 bits disponibles y de que el cálculo de bits de PAGE_OFFSET no se desborde."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "include/linux/mm.h",
            "net/core/page_pool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4f51fb0d257ff4d406ec27966902de075e3b118e",
              "lessThan": "15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95",
              "lessThan": "f62934cea32c8f7b11b747975d69bf5afe4264cf",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ee62ce7a1d909ccba0399680a03c2dee83bcae95",
              "lessThan": "95920c2ed02bde551ab654e9749c2ca7bc3100e0",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c30ae60f41f9edd6e1b5cad41cf28ce04dae39e4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "6.12.34",
              "lessThan": "6.12.54",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.15.3",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "include/linux/mm.h",
            "net/core/page_pool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.54",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.4",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-15T21:57:57.920017Z",
          "id": "CVE-2025-40199",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/95920c2ed02bde551ab654e9749c2ca7bc3100e0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f62934cea32c8f7b11b747975d69bf5afe4264cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}