Executive brief
A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash. The issue occurs when the system attempts to delete large memory pages (HugeTLB) while they are simultaneously being moved or accessed. This race condition leads to internal kernel errors, potentially disrupting operations or allowing for further system instability.
Technical details
A race condition exists in the Linux kernel's mm/hugetlb component between folio migration and hole punching (fallocate). The function remove_inode_single_folio checks if a folio is mapped without holding the folio lock. If migration occurs simultaneously, folio_mapped() may incorrectly return false because the PTE has been converted to a migration entry. This results in the folio being deleted while still mapped, triggering a BUG in filemap_unaccount_folio. The fix involves acquiring the folio lock before checking the mapping status to synchronize with concurrent migration processes.
Affected products
- Linux Linux Kernel 4.5 to 6.11.y
Timeline
- 2025-09-12: disclosed: Initial patch submission
- 2025-10-20: advisory: CVE-2025-40006 published
References
- https://git.kernel.org/stable/c/21ee79ce938127f88fe07e409c1817f477dbe7ea
- https://git.kernel.org/stable/c/3e851448078f5b01f6264915df3cfef75e323a12
- https://git.kernel.org/stable/c/7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7
- https://git.kernel.org/stable/c/910d7749346c4b0acdc6e4adfdc4a9984281a206
- https://git.kernel.org/stable/c/91f548e920fbf8be3f285bfa3fa045ae017e836d
- https://git.kernel.org/stable/c/bc1c9ce8aeff45318332035dbef9713fb9e982d7
- https://git.kernel.org/stable/c/c1dc0524ab2cc3982d4e0d2bfac71a0cd4d65c39