Executive brief
A vulnerability in the Linux kernel's memory management system can cause certain 32-bit systems to crash during boot or operation. The issue stems from how the system identifies specific memory pages used for high-performance networking. If triggered, this leads to a complete system failure (denial of service), potentially impacting the availability of services running on affected hardware.
Technical details
The vulnerability exists in the page_pool allocator where the PP_MAGIC_MASK was defined too broadly for certain 32-bit architectures (such as parisc). This causes page_pool_page_is_pp() to incorrectly identify arbitrary kernel pointers as page_pool-tagged pages. When these false positives occur, the kernel attempts to process the memory as a page_pool page, resulting in a kernel panic or crash. The fix adjusts PP_DMA_INDEX_BITS to use PAGE_OFFSET as a boundary to ensure valid kernel pointers are not mistaken for page_pool tags, or disables dma_index storage entirely if sufficient bits are unavailable. Patches have been merged into stable branches including 6.12.y and 6.17.y.
Affected products
- Linux Linux Kernel 6.12.34 to 6.12.54, 6.15.3 to 6.16
Timeline
- 2025-09-30: patched: Initial fix authored by Toke Høiland-Jørgensen
- 2025-11-12: disclosed: CVE-2025-40199 published