Junglewise Threat Intelligence

CVE-2025-40040: Linux Kernel flag-dropping in ksm_madvise

CVE-2025-40040 · Severity: high · CVSS 7.8 · Published 2025-10-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was discovered in the Linux kernel's memory management system that can cause the system to crash or behave unpredictably. When a specific memory management command (MADV_UNMERGEABLE) is used on systems with certain configurations, the kernel accidentally clears important security and operational flags. This can lead to a complete system failure (kernel panic) or potentially allow an attacker to bypass memory protections, impacting the stability and security of the operating system.

Technical details

A vulnerability exists in ksm_madvise() within the Linux kernel due to improper type promotion during bitwise operations on 64-bit architectures. When MADV_UNMERGEABLE is called, the VM_MERGEABLE flag (defined as a 32-bit unsigned int 0x80000000) is bitwise NOT-ed and then promoted to a 64-bit unsigned long. Because the leading bit of the 32-bit result is 0, the promotion zero-fills the upper 32 bits, causing an AND operation to accidentally clear all VMA flags in the upper 32-bit range (including UFFD flags). This results in a kernel BUG or WARNING in userfaultfd_release_all() due to state inconsistency. The fix involves redefining VM_MERGEABLE using the BIT() macro to ensure it is treated as an unsigned long.

Affected products

  • Linux Linux Kernel 6.16.0-rc6; stable branches including 6.1, 6.6, 6.10, 6.11, 6.12

Timeline

  • 2025-10-01: patched: Initial patch authored by Jakub Acs
  • 2025-10-28: advisory: CVE-2025-40040 published

References

Related threats