Executive brief
A vulnerability was discovered in the Linux kernel's memory management system that can cause the system to crash or behave unpredictably. When a specific memory management command (MADV_UNMERGEABLE) is used on systems with certain configurations, the kernel accidentally clears important security and operational flags. This can lead to a complete system failure (kernel panic) or potentially allow an attacker to bypass memory protections, impacting the stability and security of the operating system.
Technical details
A vulnerability exists in ksm_madvise() within the Linux kernel due to improper type promotion during bitwise operations on 64-bit architectures. When MADV_UNMERGEABLE is called, the VM_MERGEABLE flag (defined as a 32-bit unsigned int 0x80000000) is bitwise NOT-ed and then promoted to a 64-bit unsigned long. Because the leading bit of the 32-bit result is 0, the promotion zero-fills the upper 32 bits, causing an AND operation to accidentally clear all VMA flags in the upper 32-bit range (including UFFD flags). This results in a kernel BUG or WARNING in userfaultfd_release_all() due to state inconsistency. The fix involves redefining VM_MERGEABLE using the BIT() macro to ensure it is treated as an unsigned long.
Affected products
- Linux Linux Kernel 6.16.0-rc6; stable branches including 6.1, 6.6, 6.10, 6.11, 6.12
Timeline
- 2025-10-01: patched: Initial patch authored by Jakub Acs
- 2025-10-28: advisory: CVE-2025-40040 published
References
- https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693
- https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe
- https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239
- https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71
- https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60
- https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18
- https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd