CVE-2025-40006
BaseFortify
Publication date: 2025-10-20
Last updated on: 2025-10-21
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17.0-rc5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves a race condition during memory migration of huge pages. Specifically, when a folio (a group of pages) is being deleted, it may still be mapped due to a race between migration and fallocating a hole. The function remove_inode_single_folio attempts to unmap the folio but does so without holding the folio lock, which can cause it to miss that the folio is still mapped if the page table entry has been converted to a migration entry. This leads to an extra reference count being held, migration failing, and eventually triggering a kernel BUG due to a bad page cache state.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to hit a BUG condition, potentially leading to system instability or crashes when handling huge pages. It affects the memory management subsystem, which could disrupt applications relying on huge pages for performance, and may cause unexpected behavior or downtime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for the specific BUG message related to the hugetlb page cache issue. Look for log entries containing 'BUG: Bad page cache in process hugetlb' and details about 'page dumped because: still mapped when deleted'. You can use commands like 'dmesg | grep -i hugetlb' or 'journalctl -k | grep -i hugetlb' to find such messages in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by holding the folio lock before checking if the folio is mapped to avoid race conditions during migration. Until an update is applied, monitoring for the BUG messages and avoiding workloads that heavily use hugetlb page migration may reduce exposure.