Executive brief
A vulnerability in the Linux kernel's support for the Nios II processor architecture could lead to system instability or crashes. The issue occurs during the system startup process when memory limits are incorrectly calculated, potentially allowing the system to attempt to access memory addresses that do not exist. This can result in a kernel panic, effectively shutting down the system and impacting service availability.
Technical details
In the Linux kernel's nios2 architecture implementation, when CONFIG_FLATMEM is enabled, the system relies on memblock_get_current_limit() to determine mem_map limits during boot. Because memblock.current_limit is default-initialized to MEMBLOCK_ALLOC_ANYWHERE, the max_low_pfn value can erroneously exceed the actual max_pfn (the physical DRAM range). This mismatch leads to kernel-level paging failures and 'Unable to handle kernel paging request' errors, resulting in a kernel panic. The fix introduces adjust_lowmem_bounds to pre-calculate the current_limit based on available memory ranges before PFN limits are set. Patches are available in various stable branches including 5.15.196, 6.1.158, 6.6.115, 6.12.56, and 6.17.6.
Affected products
- Linux Linux Kernel 5.12 to 6.17.6
Timeline
- 2025-08-21: patched: Initial fix authored
- 2025-12-04: disclosed: CVE-2025-40245 published
References
- https://git.kernel.org/stable/c/25f09699edd360b534ccae16bc276c3b52c471f3
- https://git.kernel.org/stable/c/5c3e38a367822f036227dd52bac82dc4a05157e2
- https://git.kernel.org/stable/c/8912814f14e298b83df072fecc1f7ed1b63b1b2c
- https://git.kernel.org/stable/c/90f5f715550e07cd6a51f80fc3f062d832c8c997
- https://git.kernel.org/stable/c/a20b83cf45be2057f3d073506779e52c7fa17f94
- https://git.kernel.org/stable/c/b1ec9faef7e36269ca3ec890972a78effbaeb975