CVE-2025-40009 (GCVE-0-2025-40009)
Vulnerability from cvelistv5
Published
2025-10-20 15:26
Modified
2025-10-20 15:26
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: check p->vec_buf for NULL When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches pagemap_scan_backout_range(), kernel panics with null-ptr-deref: [ 44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none) [ 44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80 <snip registers, unreliable trace> [ 44.946828] Call Trace: [ 44.947030] <TASK> [ 44.949219] pagemap_scan_pmd_entry+0xec/0xfa0 [ 44.952593] walk_pmd_range.isra.0+0x302/0x910 [ 44.954069] walk_pud_range.isra.0+0x419/0x790 [ 44.954427] walk_p4d_range+0x41e/0x620 [ 44.954743] walk_pgd_range+0x31e/0x630 [ 44.955057] __walk_page_range+0x160/0x670 [ 44.956883] walk_page_range_mm+0x408/0x980 [ 44.958677] walk_page_range+0x66/0x90 [ 44.958984] do_pagemap_scan+0x28d/0x9c0 [ 44.961833] do_pagemap_cmd+0x59/0x80 [ 44.962484] __x64_sys_ioctl+0x18d/0x210 [ 44.962804] do_syscall_64+0x5b/0x290 [ 44.963111] entry_SYSCALL_64_after_hwframe+0x76/0x7e vec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are allocated and p->vec_buf remains set to NULL. This breaks an assumption made later in pagemap_scan_backout_range(), that page_region is always allocated for p->vec_buf_index. Fix it by explicitly checking p->vec_buf for NULL before dereferencing. Other sites that might run into same deref-issue are already (directly or transitively) protected by checking p->vec_buf. Note: From PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output is requested and it's only the side effects caller is interested in, hence it passes check in pagemap_scan_get_args(). This issue was found by syzkaller.
References
Impacted products
Vendor Product Version
Linux Linux Version: 52526ca7fdb905a768a93f8faa418e9b988fc34b
Version: 52526ca7fdb905a768a93f8faa418e9b988fc34b
Version: 52526ca7fdb905a768a93f8faa418e9b988fc34b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca988dcdc6683ecd9de5f525ce469588a9141c21",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            },
            {
              "lessThan": "a2cb8818a3d915cd33a1e8b2babc1bb0c34862c3",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            },
            {
              "lessThan": "28aa29986dde79e8466bc87569141291053833f5",
              "status": "affected",
              "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: check p-\u003evec_buf for NULL\n\nWhen the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches\npagemap_scan_backout_range(), kernel panics with null-ptr-deref:\n\n[   44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n[   44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none)\n[   44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80\n\n\u003csnip registers, unreliable trace\u003e\n\n[   44.946828] Call Trace:\n[   44.947030]  \u003cTASK\u003e\n[   44.949219]  pagemap_scan_pmd_entry+0xec/0xfa0\n[   44.952593]  walk_pmd_range.isra.0+0x302/0x910\n[   44.954069]  walk_pud_range.isra.0+0x419/0x790\n[   44.954427]  walk_p4d_range+0x41e/0x620\n[   44.954743]  walk_pgd_range+0x31e/0x630\n[   44.955057]  __walk_page_range+0x160/0x670\n[   44.956883]  walk_page_range_mm+0x408/0x980\n[   44.958677]  walk_page_range+0x66/0x90\n[   44.958984]  do_pagemap_scan+0x28d/0x9c0\n[   44.961833]  do_pagemap_cmd+0x59/0x80\n[   44.962484]  __x64_sys_ioctl+0x18d/0x210\n[   44.962804]  do_syscall_64+0x5b/0x290\n[   44.963111]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nvec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are\nallocated and p-\u003evec_buf remains set to NULL.\n\nThis breaks an assumption made later in pagemap_scan_backout_range(), that\npage_region is always allocated for p-\u003evec_buf_index.\n\nFix it by explicitly checking p-\u003evec_buf for NULL before dereferencing.\n\nOther sites that might run into same deref-issue are already (directly or\ntransitively) protected by checking p-\u003evec_buf.\n\nNote:\nFrom PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output\nis requested and it\u0027s only the side effects caller is interested in,\nhence it passes check in pagemap_scan_get_args().\n\nThis issue was found by syzkaller."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-20T15:26:55.208Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca988dcdc6683ecd9de5f525ce469588a9141c21"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2cb8818a3d915cd33a1e8b2babc1bb0c34862c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/28aa29986dde79e8466bc87569141291053833f5"
        }
      ],
      "title": "fs/proc/task_mmu: check p-\u003evec_buf for NULL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40009",
    "datePublished": "2025-10-20T15:26:55.208Z",
    "dateReserved": "2025-04-16T07:20:57.151Z",
    "dateUpdated": "2025-10-20T15:26:55.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40009\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-20T16:15:37.593\",\"lastModified\":\"2025-10-21T19:31:25.450\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/proc/task_mmu: check p-\u003evec_buf for NULL\\n\\nWhen the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches\\npagemap_scan_backout_range(), kernel panics with null-ptr-deref:\\n\\n[   44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\\n[   44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\\n[   44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none)\\n[   44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\\n[   44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80\\n\\n\u003csnip registers, unreliable trace\u003e\\n\\n[   44.946828] Call Trace:\\n[   44.947030]  \u003cTASK\u003e\\n[   44.949219]  pagemap_scan_pmd_entry+0xec/0xfa0\\n[   44.952593]  walk_pmd_range.isra.0+0x302/0x910\\n[   44.954069]  walk_pud_range.isra.0+0x419/0x790\\n[   44.954427]  walk_p4d_range+0x41e/0x620\\n[   44.954743]  walk_pgd_range+0x31e/0x630\\n[   44.955057]  __walk_page_range+0x160/0x670\\n[   44.956883]  walk_page_range_mm+0x408/0x980\\n[   44.958677]  walk_page_range+0x66/0x90\\n[   44.958984]  do_pagemap_scan+0x28d/0x9c0\\n[   44.961833]  do_pagemap_cmd+0x59/0x80\\n[   44.962484]  __x64_sys_ioctl+0x18d/0x210\\n[   44.962804]  do_syscall_64+0x5b/0x290\\n[   44.963111]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\nvec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are\\nallocated and p-\u003evec_buf remains set to NULL.\\n\\nThis breaks an assumption made later in pagemap_scan_backout_range(), that\\npage_region is always allocated for p-\u003evec_buf_index.\\n\\nFix it by explicitly checking p-\u003evec_buf for NULL before dereferencing.\\n\\nOther sites that might run into same deref-issue are already (directly or\\ntransitively) protected by checking p-\u003evec_buf.\\n\\nNote:\\nFrom PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output\\nis requested and it\u0027s only the side effects caller is interested in,\\nhence it passes check in pagemap_scan_get_args().\\n\\nThis issue was found by syzkaller.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28aa29986dde79e8466bc87569141291053833f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2cb8818a3d915cd33a1e8b2babc1bb0c34862c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ca988dcdc6683ecd9de5f525ce469588a9141c21\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.