Junglewise Threat Intelligence

CVE-2025-38364: Linux Kernel null pointer dereference in maple tree memory management

CVE-2025-38364 · Severity: medium · CVSS 5.5 · Published 2025-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's memory management system could allow a local user to crash the system. The issue occurs within the 'maple tree' data structure, which the kernel uses to manage memory areas. An exploit can trigger a system crash (null pointer dereference), potentially leading to a denial-of-service condition that disrupts operations and requires a reboot.

Technical details

A vulnerability exists in the Linux kernel's maple tree implementation where the MA_STATE_PREALLOC flag is not correctly managed during node allocation. In mas_preallocate(), the kernel fails to temporarily clear this flag when requesting new allocations; because the flag is intended to prevent re-allocation in bulk mode, its presence causes subsequent allocation requests to be ignored. This leads to an inconsistent state where a WARN_ON() is triggered, followed by a null pointer dereference when the kernel attempts to access nodes that were never allocated. The issue is particularly visible during vma merge retries in mmap_region(). Patches have been released for multiple stable kernel branches including 6.1, 6.6, and 6.12+.

Affected products

  • Linux Linux Kernel 6.1.x, 6.2.x, 6.6.x, 6.7.x, 6.12.x, 6.13.x, 6.15.x

Timeline

  • 2025-07-25: disclosed
  • 2025-07-25: advisory
  • 2025-07-06: patched: Initial patches committed to stable trees.

References

Related threats