In the Linux kernel, the following vulnerability has been resolved:
mm/smaps: fix race between smapshugetlbrange and migration
smapshugetlbrange() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUGON in pfnswapentryto_page(). The race is as follows.
smapshugetlbrange migratepages hugeptepget removemigrationptes foliounlock pfnswapentryfolio BUGON
To fix it, hold ptl lock in smapshugetlbrange().
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39754.json"
}