CVE-2025-40218

{
  "id": "CVE-2025-40218",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-04T15:15:57.643",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/vaddr: do not repeat pte_offset_map_lock() until success\n\nDAMON's virtual address space operation set implementation (vaddr) calls\npte_offset_map_lock() inside the page table walk callback function.  This\nis for reading and writing page table accessed bits.  If\npte_offset_map_lock() fails, it retries by returning the page table walk\ncallback function with ACTION_AGAIN.\n\npte_offset_map_lock() can continuously fail if the target is a pmd\nmigration entry, though.  Hence it could cause an infinite page table walk\nif the migration cannot be done until the page table walk is finished. \nThis indeed caused a soft lockup when CPU hotplugging and DAMON were\nrunning in parallel.\n\nAvoid the infinite loop by simply not retrying the page table walk.  DAMON\nis promising only a best-effort accuracy, so missing access to such pages\nis no problem."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/vaddr: no repetir pte_offset_map_lock() hasta el éxito\n\nLa implementación del conjunto de operaciones del espacio de direcciones virtuales de DAMON (vaddr) llama a pte_offset_map_lock() dentro de la función de *callback* de recorrido de la tabla de páginas. Esto es para leer y escribir bits de acceso de la tabla de páginas. Si pte_offset_map_lock() falla, reintenta devolviendo la función de *callback* de recorrido de la tabla de páginas con ACTION_AGAIN.\n\npte_offset_map_lock() puede fallar continuamente, sin embargo, si el objetivo es una entrada de migración pmd. Por lo tanto, podría causar un recorrido infinito de la tabla de páginas si la migración no se puede realizar hasta que el recorrido de la tabla de páginas haya terminado. Esto de hecho causó un *soft lockup* cuando el *hotplugging* de CPU y DAMON se ejecutaban en paralelo.\n\nEvite el bucle infinito simplemente no reintentando el recorrido de la tabla de páginas. DAMON solo promete una precisión de “mejor esfuerzo”, por lo que la falta de acceso a dichas páginas no es un problema."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "mm/damon/vaddr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7780d04046a2288ab85d88bedacc60fa4fad9971",
              "lessThan": "677ebfe5d00f94adec0c0204f6e6e2a82d3f77bf",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7780d04046a2288ab85d88bedacc60fa4fad9971",
              "lessThan": "ac42320ec873bfe726141069cfdd90ee5bc4e885",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7780d04046a2288ab85d88bedacc60fa4fad9971",
              "lessThan": "0ccd91cf749536d41307a07e60ec14ab0dbf21f5",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7780d04046a2288ab85d88bedacc60fa4fad9971",
              "lessThan": "b93af2cc8e036754c0d9970d9ddc47f43cc94b9f",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "mm/damon/vaddr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.5",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.5",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.113",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.54",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.4",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0ccd91cf749536d41307a07e60ec14ab0dbf21f5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/677ebfe5d00f94adec0c0204f6e6e2a82d3f77bf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ac42320ec873bfe726141069cfdd90ee5bc4e885",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b93af2cc8e036754c0d9970d9ddc47f43cc94b9f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}