CVE-2025-39776
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-39776
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39776.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-39776
- Downstream
- Published
- 2025-09-11T16:56:28Z
- Modified
- 2025-10-10T18:22:28.582003Z
- Summary
- mm/debug_vm_pgtable: clear page table entries at destroy_args()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
mm/debugvmpgtable: clear page table entries at destroy_args()
The mm/debugvmpagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mmstruct. That in itself is ok, but when it exits, at destroyargs() it fails to clear those entries with the *_clear functions.
The problem is that leaves stale entries. If another process allocates an mmstruct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIGDEBUGVMPGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtablesbytes goes negative, in addition to the warning at checkmm() function):
[ 2.539366] kmemcache info [ 2.539374] kmemcachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 freepudrange+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debugvm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debugvm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] freepudrange+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] freepudrange+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] freepudrange+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] freepgdrange+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] freepgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exitmmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] _mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exitmm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] doexit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] dogroupexit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sysexitgroup+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] systemcallexception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] systemcallvectoredcommon+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MMANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144
Here the modprobe process ended up with an allocated mmstruct from the mmstruct slab that was used before by the debugvmpgtable test. That is not a problem, since the mm_stru ---truncated---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/47d2a149611b8a94d24add9868c442a4af278658
- https://git.kernel.org/stable/c/561171db3b3eb759ba3f284dba7a76f4476ade03
- https://git.kernel.org/stable/c/61a9f2e5c49f05e3ea2c16674540a075a1b4be6f
- https://git.kernel.org/stable/c/63962ff932ef359925b94be2a88df6b4fd4fed0a
- https://git.kernel.org/stable/c/7bf57a0709cd7c9088cea8de023d6f4fbf2518b0
- https://git.kernel.org/stable/c/dde30854bddfb5d69f30022b53c5955a41088b33
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70aFixed7bf57a0709cd7c9088cea8de023d6f4fbf2518b0
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70aFixed47d2a149611b8a94d24add9868c442a4af278658
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70aFixed63962ff932ef359925b94be2a88df6b4fd4fed0a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70aFixed61a9f2e5c49f05e3ea2c16674540a075a1b4be6f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70aFixed561171db3b3eb759ba3f284dba7a76f4476ade03
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70aFixeddde30854bddfb5d69f30022b53c5955a41088b33