CVE-2025-39776 (GCVE-0-2025-39776)
Vulnerability from cvelistv5
Published
2025-09-11 16:56
Modified
2025-09-11 16:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/debug_vm_pgtable: clear page table entries at destroy_args()
The mm/debug_vm_pagetable test allocates manually page table entries for
the tests it runs, using also its manually allocated mm_struct. That in
itself is ok, but when it exits, at destroy_args() it fails to clear those
entries with the *_clear functions.
The problem is that leaves stale entries. If another process allocates an
mm_struct with a pgd at the same address, it may end up running into the
stale entry. This is happening in practice on a debug kernel with
CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra
debugging I added (it prints a warning trace if pgtables_bytes goes
negative, in addition to the warning at check_mm() function):
[ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000
[ 2.539366] kmem_cache info
[ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508
[ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e
(...)
[ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0
[ 2.552816] Modules linked in:
[ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY
[ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries
[ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90
[ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug)
[ 2.552899] MSR: 800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24002822 XER: 0000000a
[ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0
[ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001
[ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff
[ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000
[ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb
[ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0
[ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000
[ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001
[ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760
[ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0
[ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0
[ 2.553199] Call Trace:
[ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable)
[ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0
[ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570
[ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650
[ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290
[ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0
[ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870
[ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150
[ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50
[ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0
[ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
(...)
[ 2.558892] ---[ end trace 0000000000000000 ]---
[ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1
[ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144
Here the modprobe process ended up with an allocated mm_struct from the
mm_struct slab that was used before by the debug_vm_pgtable test. That is
not a problem, since the mm_stru
---truncated---
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a Version: 3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a Version: 3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a Version: 3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a Version: 3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a Version: 3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/debug_vm_pgtable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7bf57a0709cd7c9088cea8de023d6f4fbf2518b0",
"status": "affected",
"version": "3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a",
"versionType": "git"
},
{
"lessThan": "47d2a149611b8a94d24add9868c442a4af278658",
"status": "affected",
"version": "3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a",
"versionType": "git"
},
{
"lessThan": "63962ff932ef359925b94be2a88df6b4fd4fed0a",
"status": "affected",
"version": "3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a",
"versionType": "git"
},
{
"lessThan": "61a9f2e5c49f05e3ea2c16674540a075a1b4be6f",
"status": "affected",
"version": "3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a",
"versionType": "git"
},
{
"lessThan": "561171db3b3eb759ba3f284dba7a76f4476ade03",
"status": "affected",
"version": "3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a",
"versionType": "git"
},
{
"lessThan": "dde30854bddfb5d69f30022b53c5955a41088b33",
"status": "affected",
"version": "3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/debug_vm_pgtable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.149",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17-rc3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.190",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.149",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.103",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.44",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17-rc3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/debug_vm_pgtable: clear page table entries at destroy_args()\n\nThe mm/debug_vm_pagetable test allocates manually page table entries for\nthe tests it runs, using also its manually allocated mm_struct. That in\nitself is ok, but when it exits, at destroy_args() it fails to clear those\nentries with the *_clear functions.\n\nThe problem is that leaves stale entries. If another process allocates an\nmm_struct with a pgd at the same address, it may end up running into the\nstale entry. This is happening in practice on a debug kernel with\nCONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra\ndebugging I added (it prints a warning trace if pgtables_bytes goes\nnegative, in addition to the warning at check_mm() function):\n\n[ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000\n[ 2.539366] kmem_cache info\n[ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508\n[ 2.539447] debug_vm_pgtable: [init_args ]: args-\u003emm is 0x000000002267cc9e\n(...)\n[ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0\n[ 2.552816] Modules linked in:\n[ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY\n[ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries\n[ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90\n[ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug)\n[ 2.552899] MSR: 800000000282b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e CR: 24002822 XER: 0000000a\n[ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0\n[ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001\n[ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff\n[ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000\n[ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb\n[ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0\n[ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000\n[ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001\n[ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760\n[ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0\n[ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0\n[ 2.553199] Call Trace:\n[ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable)\n[ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0\n[ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570\n[ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650\n[ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290\n[ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0\n[ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870\n[ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150\n[ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50\n[ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0\n[ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\n(...)\n[ 2.558892] ---[ end trace 0000000000000000 ]---\n[ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1\n[ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144\n\nHere the modprobe process ended up with an allocated mm_struct from the\nmm_struct slab that was used before by the debug_vm_pgtable test. That is\nnot a problem, since the mm_stru\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2025-09-11T16:56:28.936Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7bf57a0709cd7c9088cea8de023d6f4fbf2518b0"
},
{
"url": "https://git.kernel.org/stable/c/47d2a149611b8a94d24add9868c442a4af278658"
},
{
"url": "https://git.kernel.org/stable/c/63962ff932ef359925b94be2a88df6b4fd4fed0a"
},
{
"url": "https://git.kernel.org/stable/c/61a9f2e5c49f05e3ea2c16674540a075a1b4be6f"
},
{
"url": "https://git.kernel.org/stable/c/561171db3b3eb759ba3f284dba7a76f4476ade03"
},
{
"url": "https://git.kernel.org/stable/c/dde30854bddfb5d69f30022b53c5955a41088b33"
}
],
"title": "mm/debug_vm_pgtable: clear page table entries at destroy_args()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39776",
"datePublished": "2025-09-11T16:56:28.936Z",
"dateReserved": "2025-04-16T07:20:57.129Z",
"dateUpdated": "2025-09-11T16:56:28.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-39776\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-11T17:15:43.457\",\"lastModified\":\"2025-09-15T15:22:38.297\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/debug_vm_pgtable: clear page table entries at destroy_args()\\n\\nThe mm/debug_vm_pagetable test allocates manually page table entries for\\nthe tests it runs, using also its manually allocated mm_struct. That in\\nitself is ok, but when it exits, at destroy_args() it fails to clear those\\nentries with the *_clear functions.\\n\\nThe problem is that leaves stale entries. If another process allocates an\\nmm_struct with a pgd at the same address, it may end up running into the\\nstale entry. This is happening in practice on a debug kernel with\\nCONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra\\ndebugging I added (it prints a warning trace if pgtables_bytes goes\\nnegative, in addition to the warning at check_mm() function):\\n\\n[ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000\\n[ 2.539366] kmem_cache info\\n[ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508\\n[ 2.539447] debug_vm_pgtable: [init_args ]: args-\u003emm is 0x000000002267cc9e\\n(...)\\n[ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0\\n[ 2.552816] Modules linked in:\\n[ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY\\n[ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries\\n[ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90\\n[ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug)\\n[ 2.552899] MSR: 800000000282b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e CR: 24002822 XER: 0000000a\\n[ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0\\n[ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001\\n[ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff\\n[ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000\\n[ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb\\n[ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0\\n[ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000\\n[ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001\\n[ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760\\n[ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0\\n[ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0\\n[ 2.553199] Call Trace:\\n[ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable)\\n[ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0\\n[ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570\\n[ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650\\n[ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290\\n[ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0\\n[ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870\\n[ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150\\n[ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50\\n[ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0\\n[ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\\n(...)\\n[ 2.558892] ---[ end trace 0000000000000000 ]---\\n[ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1\\n[ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144\\n\\nHere the modprobe process ended up with an allocated mm_struct from the\\nmm_struct slab that was used before by the debug_vm_pgtable test. That is\\nnot a problem, since the mm_stru\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/47d2a149611b8a94d24add9868c442a4af278658\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/561171db3b3eb759ba3f284dba7a76f4476ade03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/61a9f2e5c49f05e3ea2c16674540a075a1b4be6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/63962ff932ef359925b94be2a88df6b4fd4fed0a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7bf57a0709cd7c9088cea8de023d6f4fbf2518b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dde30854bddfb5d69f30022b53c5955a41088b33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…