CVE-2025-40009
BaseFortify
Publication date: 2025-10-20
Last updated on: 2025-10-21
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17.0-rc6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's handling of the PAGEMAP_SCAN ioctl when the vec_len parameter is set to 0. In this case, no buffer is allocated, leaving a pointer (p->vec_buf) as NULL. Later, the kernel code incorrectly assumes this pointer is always valid and dereferences it, causing a null pointer dereference that leads to a kernel panic (crash). The issue arises because the code does not check if p->vec_buf is NULL before using it, breaking an assumption about buffer allocation.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash (kernel panic) when the PAGEMAP_SCAN ioctl is invoked with vec_len = 0. A kernel panic results in a denial of service, as the system becomes unstable or unresponsive until rebooted. This could be exploited by an attacker or triggered unintentionally, leading to system downtime and potential loss of availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for kernel panic messages related to null pointer dereferences when the PAGEMAP_SCAN ioctl is invoked with vec_len = 0. Specifically, look for kernel oops messages mentioning 'null-ptr-deref' and call traces involving pagemap_scan functions. You can use commands like 'dmesg | grep -i "null-ptr-deref"' or 'journalctl -k | grep -i "pagemap_scan"' to find relevant kernel log entries indicating this issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, which includes the explicit check for p->vec_buf being NULL before dereferencing. Until the update is applied, avoid invoking the PAGEMAP_SCAN ioctl with vec_len = 0 to prevent triggering the kernel panic.