CVE-2025-37922 (GCVE-0-2025-37922)
Vulnerability from cvelistv5
Published
2025-05-20 15:21
Modified
2025-05-26 05:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: book3s64/radix : Align section vmemmap start address to PAGE_SIZE A vmemmap altmap is a device-provided region used to provide backing storage for struct pages. For each namespace, the altmap should belong to that same namespace. If the namespaces are created unaligned, there is a chance that the section vmemmap start address could also be unaligned. If the section vmemmap start address is unaligned, the altmap page allocated from the current namespace might be used by the previous namespace also. During the free operation, since the altmap is shared between two namespaces, the previous namespace may detect that the page does not belong to its altmap and incorrectly assume that the page is a normal page. It then attempts to free the normal page, which leads to a kernel crash. Kernel attempted to read user page (18) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000018 Faulting instruction address: 0xc000000000530c7c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries CPU: 32 PID: 2104 Comm: ndctl Kdump: loaded Tainted: G W NIP: c000000000530c7c LR: c000000000530e00 CTR: 0000000000007ffe REGS: c000000015e57040 TRAP: 0300 Tainted: G W MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 84482404 CFAR: c000000000530dfc DAR: 0000000000000018 DSISR: 40000000 IRQMASK: 0 GPR00: c000000000530e00 c000000015e572e0 c000000002c5cb00 c00c000101008040 GPR04: 0000000000000000 0000000000000007 0000000000000001 000000000000001f GPR08: 0000000000000005 0000000000000000 0000000000000018 0000000000002000 GPR12: c0000000001d2fb0 c0000060de6b0080 0000000000000000 c0000060dbf90020 GPR16: c00c000101008000 0000000000000001 0000000000000000 c000000125b20f00 GPR20: 0000000000000001 0000000000000000 ffffffffffffffff c00c000101007fff GPR24: 0000000000000001 0000000000000000 0000000000000000 0000000000000000 GPR28: 0000000004040201 0000000000000001 0000000000000000 c00c000101008040 NIP [c000000000530c7c] get_pfnblock_flags_mask+0x7c/0xd0 LR [c000000000530e00] free_unref_page_prepare+0x130/0x4f0 Call Trace: free_unref_page+0x50/0x1e0 free_reserved_page+0x40/0x68 free_vmemmap_pages+0x98/0xe0 remove_pte_table+0x164/0x1e8 remove_pmd_table+0x204/0x2c8 remove_pud_table+0x1c4/0x288 remove_pagetable+0x1c8/0x310 vmemmap_free+0x24/0x50 section_deactivate+0x28c/0x2a0 __remove_pages+0x84/0x110 arch_remove_memory+0x38/0x60 memunmap_pages+0x18c/0x3d0 devm_action_release+0x30/0x50 release_nodes+0x68/0x140 devres_release_group+0x100/0x190 dax_pmem_compat_release+0x44/0x80 [dax_pmem_compat] device_for_each_child+0x8c/0x100 [dax_pmem_compat_remove+0x2c/0x50 [dax_pmem_compat] nvdimm_bus_remove+0x78/0x140 [libnvdimm] device_remove+0x70/0xd0 Another issue is that if there is no altmap, a PMD-sized vmemmap page will be allocated from RAM, regardless of the alignment of the section start address. If the section start address is not aligned to the PMD size, a VM_BUG_ON will be triggered when setting the PMD-sized page to page table. In this patch, we are aligning the section vmemmap start address to PAGE_SIZE. After alignment, the start address will not be part of the current namespace, and a normal page will be allocated for the vmemmap mapping of the current section. For the remaining sections, altmaps will be allocated. During the free operation, the normal page will be correctly freed. In the same way, a PMD_SIZE vmemmap page will be allocated only if the section start address is PMD_SIZE-aligned; otherwise, it will fall back to a PAGE-sized vmemmap allocation. Without this patch ================== NS1 start NS2 start _________________________________________________________ | NS1 | NS2 | --------------------------------------------------------- | Altmap| Altmap | .....|Altmap| Altmap | ........... | NS1 | NS1 ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: 368a0590d954a659b16ab945328ada0cc10f93a0
Version: 368a0590d954a659b16ab945328ada0cc10f93a0
Version: 368a0590d954a659b16ab945328ada0cc10f93a0
Version: 368a0590d954a659b16ab945328ada0cc10f93a0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/book3s64/radix_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a8d4d7072d4df108479b1adc4b0840e96f6f61d",
              "status": "affected",
              "version": "368a0590d954a659b16ab945328ada0cc10f93a0",
              "versionType": "git"
            },
            {
              "lessThan": "7f5476d80f2cb364701cd1fa138a14b241ca99e9",
              "status": "affected",
              "version": "368a0590d954a659b16ab945328ada0cc10f93a0",
              "versionType": "git"
            },
            {
              "lessThan": "400be767deaf31a073c6d14c5d151ae5ac2a60e2",
              "status": "affected",
              "version": "368a0590d954a659b16ab945328ada0cc10f93a0",
              "versionType": "git"
            },
            {
              "lessThan": "9cf7e13fecbab0894f6986fc6986ab2eba8de52e",
              "status": "affected",
              "version": "368a0590d954a659b16ab945328ada0cc10f93a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/mm/book3s64/radix_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbook3s64/radix : Align section vmemmap start address to PAGE_SIZE\n\nA vmemmap altmap is a device-provided region used to provide\nbacking storage for struct pages. For each namespace, the altmap\nshould belong to that same namespace. If the namespaces are\ncreated unaligned, there is a chance that the section vmemmap\nstart address could also be unaligned. If the section vmemmap\nstart address is unaligned, the altmap page allocated from the\ncurrent namespace might be used by the previous namespace also.\nDuring the free operation, since the altmap is shared between two\nnamespaces, the previous namespace may detect that the page does\nnot belong to its altmap and incorrectly assume that the page is a\nnormal page. It then attempts to free the normal page, which leads\nto a kernel crash.\n\nKernel attempted to read user page (18) - exploit attempt? (uid: 0)\nBUG: Kernel NULL pointer dereference on read at 0x00000018\nFaulting instruction address: 0xc000000000530c7c\nOops: Kernel access of bad area, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\nCPU: 32 PID: 2104 Comm: ndctl Kdump: loaded Tainted: G        W\nNIP:  c000000000530c7c LR: c000000000530e00 CTR: 0000000000007ffe\nREGS: c000000015e57040 TRAP: 0300   Tainted: G        W\nMSR:  800000000280b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e  CR: 84482404\nCFAR: c000000000530dfc DAR: 0000000000000018 DSISR: 40000000 IRQMASK: 0\nGPR00: c000000000530e00 c000000015e572e0 c000000002c5cb00 c00c000101008040\nGPR04: 0000000000000000 0000000000000007 0000000000000001 000000000000001f\nGPR08: 0000000000000005 0000000000000000 0000000000000018 0000000000002000\nGPR12: c0000000001d2fb0 c0000060de6b0080 0000000000000000 c0000060dbf90020\nGPR16: c00c000101008000 0000000000000001 0000000000000000 c000000125b20f00\nGPR20: 0000000000000001 0000000000000000 ffffffffffffffff c00c000101007fff\nGPR24: 0000000000000001 0000000000000000 0000000000000000 0000000000000000\nGPR28: 0000000004040201 0000000000000001 0000000000000000 c00c000101008040\nNIP [c000000000530c7c] get_pfnblock_flags_mask+0x7c/0xd0\nLR [c000000000530e00] free_unref_page_prepare+0x130/0x4f0\nCall Trace:\nfree_unref_page+0x50/0x1e0\nfree_reserved_page+0x40/0x68\nfree_vmemmap_pages+0x98/0xe0\nremove_pte_table+0x164/0x1e8\nremove_pmd_table+0x204/0x2c8\nremove_pud_table+0x1c4/0x288\nremove_pagetable+0x1c8/0x310\nvmemmap_free+0x24/0x50\nsection_deactivate+0x28c/0x2a0\n__remove_pages+0x84/0x110\narch_remove_memory+0x38/0x60\nmemunmap_pages+0x18c/0x3d0\ndevm_action_release+0x30/0x50\nrelease_nodes+0x68/0x140\ndevres_release_group+0x100/0x190\ndax_pmem_compat_release+0x44/0x80 [dax_pmem_compat]\ndevice_for_each_child+0x8c/0x100\n[dax_pmem_compat_remove+0x2c/0x50 [dax_pmem_compat]\nnvdimm_bus_remove+0x78/0x140 [libnvdimm]\ndevice_remove+0x70/0xd0\n\nAnother issue is that if there is no altmap, a PMD-sized vmemmap\npage will be allocated from RAM, regardless of the alignment of\nthe section start address. If the section start address is not\naligned to the PMD size, a VM_BUG_ON will be triggered when\nsetting the PMD-sized page to page table.\n\nIn this patch, we are aligning the section vmemmap start address\nto PAGE_SIZE. After alignment, the start address will not be\npart of the current namespace, and a normal page will be allocated\nfor the vmemmap mapping of the current section. For the remaining\nsections, altmaps will be allocated. During the free operation,\nthe normal page will be correctly freed.\n\nIn the same way, a PMD_SIZE vmemmap page will be allocated only if\nthe section start address is PMD_SIZE-aligned; otherwise, it will\nfall back to a PAGE-sized vmemmap allocation.\n\nWithout this patch\n==================\nNS1 start               NS2 start\n _________________________________________________________\n|         NS1               |            NS2              |\n ---------------------------------------------------------\n| Altmap| Altmap | .....|Altmap| Altmap | ...........\n|  NS1  |  NS1   \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:23:46.967Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a8d4d7072d4df108479b1adc4b0840e96f6f61d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f5476d80f2cb364701cd1fa138a14b241ca99e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/400be767deaf31a073c6d14c5d151ae5ac2a60e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cf7e13fecbab0894f6986fc6986ab2eba8de52e"
        }
      ],
      "title": "book3s64/radix : Align section vmemmap start address to PAGE_SIZE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37922",
    "datePublished": "2025-05-20T15:21:51.062Z",
    "dateReserved": "2025-04-16T04:51:23.969Z",
    "dateUpdated": "2025-05-26T05:23:46.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37922\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:28.827\",\"lastModified\":\"2025-05-21T20:25:16.407\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbook3s64/radix : Align section vmemmap start address to PAGE_SIZE\\n\\nA vmemmap altmap is a device-provided region used to provide\\nbacking storage for struct pages. For each namespace, the altmap\\nshould belong to that same namespace. If the namespaces are\\ncreated unaligned, there is a chance that the section vmemmap\\nstart address could also be unaligned. If the section vmemmap\\nstart address is unaligned, the altmap page allocated from the\\ncurrent namespace might be used by the previous namespace also.\\nDuring the free operation, since the altmap is shared between two\\nnamespaces, the previous namespace may detect that the page does\\nnot belong to its altmap and incorrectly assume that the page is a\\nnormal page. It then attempts to free the normal page, which leads\\nto a kernel crash.\\n\\nKernel attempted to read user page (18) - exploit attempt? (uid: 0)\\nBUG: Kernel NULL pointer dereference on read at 0x00000018\\nFaulting instruction address: 0xc000000000530c7c\\nOops: Kernel access of bad area, sig: 11 [#1]\\nLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\\nCPU: 32 PID: 2104 Comm: ndctl Kdump: loaded Tainted: G        W\\nNIP:  c000000000530c7c LR: c000000000530e00 CTR: 0000000000007ffe\\nREGS: c000000015e57040 TRAP: 0300   Tainted: G        W\\nMSR:  800000000280b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e  CR: 84482404\\nCFAR: c000000000530dfc DAR: 0000000000000018 DSISR: 40000000 IRQMASK: 0\\nGPR00: c000000000530e00 c000000015e572e0 c000000002c5cb00 c00c000101008040\\nGPR04: 0000000000000000 0000000000000007 0000000000000001 000000000000001f\\nGPR08: 0000000000000005 0000000000000000 0000000000000018 0000000000002000\\nGPR12: c0000000001d2fb0 c0000060de6b0080 0000000000000000 c0000060dbf90020\\nGPR16: c00c000101008000 0000000000000001 0000000000000000 c000000125b20f00\\nGPR20: 0000000000000001 0000000000000000 ffffffffffffffff c00c000101007fff\\nGPR24: 0000000000000001 0000000000000000 0000000000000000 0000000000000000\\nGPR28: 0000000004040201 0000000000000001 0000000000000000 c00c000101008040\\nNIP [c000000000530c7c] get_pfnblock_flags_mask+0x7c/0xd0\\nLR [c000000000530e00] free_unref_page_prepare+0x130/0x4f0\\nCall Trace:\\nfree_unref_page+0x50/0x1e0\\nfree_reserved_page+0x40/0x68\\nfree_vmemmap_pages+0x98/0xe0\\nremove_pte_table+0x164/0x1e8\\nremove_pmd_table+0x204/0x2c8\\nremove_pud_table+0x1c4/0x288\\nremove_pagetable+0x1c8/0x310\\nvmemmap_free+0x24/0x50\\nsection_deactivate+0x28c/0x2a0\\n__remove_pages+0x84/0x110\\narch_remove_memory+0x38/0x60\\nmemunmap_pages+0x18c/0x3d0\\ndevm_action_release+0x30/0x50\\nrelease_nodes+0x68/0x140\\ndevres_release_group+0x100/0x190\\ndax_pmem_compat_release+0x44/0x80 [dax_pmem_compat]\\ndevice_for_each_child+0x8c/0x100\\n[dax_pmem_compat_remove+0x2c/0x50 [dax_pmem_compat]\\nnvdimm_bus_remove+0x78/0x140 [libnvdimm]\\ndevice_remove+0x70/0xd0\\n\\nAnother issue is that if there is no altmap, a PMD-sized vmemmap\\npage will be allocated from RAM, regardless of the alignment of\\nthe section start address. If the section start address is not\\naligned to the PMD size, a VM_BUG_ON will be triggered when\\nsetting the PMD-sized page to page table.\\n\\nIn this patch, we are aligning the section vmemmap start address\\nto PAGE_SIZE. After alignment, the start address will not be\\npart of the current namespace, and a normal page will be allocated\\nfor the vmemmap mapping of the current section. For the remaining\\nsections, altmaps will be allocated. During the free operation,\\nthe normal page will be correctly freed.\\n\\nIn the same way, a PMD_SIZE vmemmap page will be allocated only if\\nthe section start address is PMD_SIZE-aligned; otherwise, it will\\nfall back to a PAGE-sized vmemmap allocation.\\n\\nWithout this patch\\n==================\\nNS1 start               NS2 start\\n _________________________________________________________\\n|         NS1               |            NS2              |\\n ---------------------------------------------------------\\n| Altmap| Altmap | .....|Altmap| Altmap | ...........\\n|  NS1  |  NS1   \\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/400be767deaf31a073c6d14c5d151ae5ac2a60e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7f5476d80f2cb364701cd1fa138a14b241ca99e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9a8d4d7072d4df108479b1adc4b0840e96f6f61d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9cf7e13fecbab0894f6986fc6986ab2eba8de52e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.