DEBIAN-CVE-2025-40199

Source
https://security-tracker.debian.org/tracker/CVE-2025-40199
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40199.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-40199
Upstream
Published
2025-11-12T22:15:47.043Z
Modified
2025-11-17T06:13:16.198371Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix PPMAGICMASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PPMAGICMASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the pagepoolpageispp() incurs false positives which crashes the machine. Just disabling the check in pagepoolispp() will lead to the pagepool code itself malfunctioning; so instead of doing this, this patch changes the define for PPDMAINDEXBITS to avoid mistaking arbitrary kernel pointers for pagepool-tagged pages. The fix relies on the kernel pointers that alias with the ppmagic field always being above PAGEOFFSET. With this assumption, we can use the lowest bit of the value of PAGEOFFSET as the upper bound of the PPDMAINDEXMASK, which should avoid the false positives. Because we cannot rely on PAGEOFFSET always being a compile-time constant, nor on it always being >0, we fall back to disabling the dmaindex storage when there are not enough bits available. This leaves us in the situation we were in before the patch in the Fixes tag, but only on a subset of architecture configurations. This seems to be the best we can do until the transition to page types in complete for pagepool pages. v2: - Make sure there's at least 8 bits available and that the PAGE_OFFSET bit calculation doesn't wrap

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.57-1

Affected versions

6.*

6.12.38-1
6.12.41-1
6.12.43-1~bpo12+1
6.12.43-1
6.12.48-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.12.38-1
6.12.41-1
6.12.43-1~bpo12+1
6.12.43-1
6.12.48-1
6.12.57-1
6.13~rc6-1~exp1
6.13~rc7-1~exp1
6.13.2-1~exp1
6.13.3-1~exp1
6.13.4-1~exp1
6.13.5-1~exp1
6.13.6-1~exp1
6.13.7-1~exp1
6.13.8-1~exp1
6.13.9-1~exp1
6.13.10-1~exp1
6.13.11-1~exp1
6.14.3-1~exp1
6.14.5-1~exp1
6.14.6-1~exp1
6.15~rc7-1~exp1
6.15-1~exp1
6.15.1-1~exp1
6.15.2-1~exp1
6.15.3-1~exp1
6.15.4-1~exp1
6.15.5-1~exp1
6.15.6-1~exp1
6.16~rc7-1~exp1
6.16-1~exp1
6.16.1-1~exp1
6.16.3-1~bpo13+1
6.16.3-1
6.16.5-1
6.16.6-1
6.16.7-1
6.16.8-1
6.16.9-1
6.16.10-1
6.16.11-1
6.16.12-1
6.16.12-2
6.17.2-1~exp1
6.17.5-1~exp1
6.17.6-1
6.17.7-1
6.17.7-2
6.17.8-1
6.18~rc4-1~exp1
6.18~rc4-1~exp2
6.18~rc5-1~exp1

Ecosystem specific

{
    "urgency": "not yet assigned"
}