CVE-2025-68198 (GCVE-0-2025-68198)
Vulnerability from cvelistv5
Published
2025-12-16 13:48
Modified
2025-12-16 13:48
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: crash: fix crashkernel resource shrink When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues: 1. Invalid crashkernel resource objects 2. Kernel crash if crashkernel shrinking is done twice For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as: cat /proc/iomem | grep -i crash af000000-beffffff : Crash kernel 433000000-43f7fffff : Crash kernel If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved: af000000-beffffff : Crash kernel Instead, it should show 50MB: af000000-b21fffff : Crash kernel Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86): BUG: kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI <snip...> Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? __release_resource+0xd/0xb0 release_resource+0x26/0x40 __crash_shrink_memory+0xe5/0x110 crash_shrink_memory+0x12a/0x190 kexec_crash_size_store+0x41/0x80 kernfs_fop_write_iter+0x141/0x1f0 vfs_write+0x294/0x460 ksys_write+0x6d/0xf0 <snip...> This happens because __crash_shrink_memory()/kernel/crash_core.c incorrectly updates the crashk_res resource object even when crashk_low_res should be updated. Fix this by ensuring the correct crashkernel resource object is updated when shrinking crashkernel memory.
References
Impacted products
Vendor Product Version
Linux Linux Version: 16c6006af4d4e70ecef93977a5314409d931020b
Version: 16c6006af4d4e70ecef93977a5314409d931020b
Version: 16c6006af4d4e70ecef93977a5314409d931020b
Version: 16c6006af4d4e70ecef93977a5314409d931020b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/crash_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f01f9c348d76d40bf104a94449e3ce4057fdefee",
              "status": "affected",
              "version": "16c6006af4d4e70ecef93977a5314409d931020b",
              "versionType": "git"
            },
            {
              "lessThan": "f89c5e7077f63e45e8ba5a77b7cf0803130367e6",
              "status": "affected",
              "version": "16c6006af4d4e70ecef93977a5314409d931020b",
              "versionType": "git"
            },
            {
              "lessThan": "a2bd247f8c6c5ac3f0ba823a2fffd77bb9cdf618",
              "status": "affected",
              "version": "16c6006af4d4e70ecef93977a5314409d931020b",
              "versionType": "git"
            },
            {
              "lessThan": "00fbff75c5acb4755f06f08bd1071879c63940c5",
              "status": "affected",
              "version": "16c6006af4d4e70ecef93977a5314409d931020b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/crash_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.118",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.118",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrash: fix crashkernel resource shrink\n\nWhen crashkernel is configured with a high reservation, shrinking its\nvalue below the low crashkernel reservation causes two issues:\n\n1. Invalid crashkernel resource objects\n2. Kernel crash if crashkernel shrinking is done twice\n\nFor example, with crashkernel=200M,high, the kernel reserves 200MB of high\nmemory and some default low memory (say 256MB).  The reservation appears\nas:\n\ncat /proc/iomem | grep -i crash\naf000000-beffffff : Crash kernel\n433000000-43f7fffff : Crash kernel\n\nIf crashkernel is then shrunk to 50MB (echo 52428800 \u003e\n/sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved:\naf000000-beffffff : Crash kernel\n\nInstead, it should show 50MB:\naf000000-b21fffff : Crash kernel\n\nFurther shrinking crashkernel to 40MB causes a kernel crash with the\nfollowing trace (x86):\n\nBUG: kernel NULL pointer dereference, address: 0000000000000038\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\n\u003csnip...\u003e\nCall Trace: \u003cTASK\u003e\n? __die_body.cold+0x19/0x27\n? page_fault_oops+0x15a/0x2f0\n? search_module_extables+0x19/0x60\n? search_bpf_extables+0x5f/0x80\n? exc_page_fault+0x7e/0x180\n? asm_exc_page_fault+0x26/0x30\n? __release_resource+0xd/0xb0\nrelease_resource+0x26/0x40\n__crash_shrink_memory+0xe5/0x110\ncrash_shrink_memory+0x12a/0x190\nkexec_crash_size_store+0x41/0x80\nkernfs_fop_write_iter+0x141/0x1f0\nvfs_write+0x294/0x460\nksys_write+0x6d/0xf0\n\u003csnip...\u003e\n\nThis happens because __crash_shrink_memory()/kernel/crash_core.c\nincorrectly updates the crashk_res resource object even when\ncrashk_low_res should be updated.\n\nFix this by ensuring the correct crashkernel resource object is updated\nwhen shrinking crashkernel memory."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T13:48:26.998Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f01f9c348d76d40bf104a94449e3ce4057fdefee"
        },
        {
          "url": "https://git.kernel.org/stable/c/f89c5e7077f63e45e8ba5a77b7cf0803130367e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2bd247f8c6c5ac3f0ba823a2fffd77bb9cdf618"
        },
        {
          "url": "https://git.kernel.org/stable/c/00fbff75c5acb4755f06f08bd1071879c63940c5"
        }
      ],
      "title": "crash: fix crashkernel resource shrink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68198",
    "datePublished": "2025-12-16T13:48:26.998Z",
    "dateReserved": "2025-12-16T13:41:40.254Z",
    "dateUpdated": "2025-12-16T13:48:26.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68198\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:52.590\",\"lastModified\":\"2025-12-18T15:08:25.907\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrash: fix crashkernel resource shrink\\n\\nWhen crashkernel is configured with a high reservation, shrinking its\\nvalue below the low crashkernel reservation causes two issues:\\n\\n1. Invalid crashkernel resource objects\\n2. Kernel crash if crashkernel shrinking is done twice\\n\\nFor example, with crashkernel=200M,high, the kernel reserves 200MB of high\\nmemory and some default low memory (say 256MB).  The reservation appears\\nas:\\n\\ncat /proc/iomem | grep -i crash\\naf000000-beffffff : Crash kernel\\n433000000-43f7fffff : Crash kernel\\n\\nIf crashkernel is then shrunk to 50MB (echo 52428800 \u003e\\n/sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved:\\naf000000-beffffff : Crash kernel\\n\\nInstead, it should show 50MB:\\naf000000-b21fffff : Crash kernel\\n\\nFurther shrinking crashkernel to 40MB causes a kernel crash with the\\nfollowing trace (x86):\\n\\nBUG: kernel NULL pointer dereference, address: 0000000000000038\\nPGD 0 P4D 0\\nOops: 0000 [#1] PREEMPT SMP NOPTI\\n\u003csnip...\u003e\\nCall Trace: \u003cTASK\u003e\\n? __die_body.cold+0x19/0x27\\n? page_fault_oops+0x15a/0x2f0\\n? search_module_extables+0x19/0x60\\n? search_bpf_extables+0x5f/0x80\\n? exc_page_fault+0x7e/0x180\\n? asm_exc_page_fault+0x26/0x30\\n? __release_resource+0xd/0xb0\\nrelease_resource+0x26/0x40\\n__crash_shrink_memory+0xe5/0x110\\ncrash_shrink_memory+0x12a/0x190\\nkexec_crash_size_store+0x41/0x80\\nkernfs_fop_write_iter+0x141/0x1f0\\nvfs_write+0x294/0x460\\nksys_write+0x6d/0xf0\\n\u003csnip...\u003e\\n\\nThis happens because __crash_shrink_memory()/kernel/crash_core.c\\nincorrectly updates the crashk_res resource object even when\\ncrashk_low_res should be updated.\\n\\nFix this by ensuring the correct crashkernel resource object is updated\\nwhen shrinking crashkernel memory.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00fbff75c5acb4755f06f08bd1071879c63940c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2bd247f8c6c5ac3f0ba823a2fffd77bb9cdf618\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f01f9c348d76d40bf104a94449e3ce4057fdefee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f89c5e7077f63e45e8ba5a77b7cf0803130367e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.