CVE-2025-68248 (GCVE-0-2025-68248)

Vulnerability from cvelistv5 – Published: 2025-12-16 14:32 – Updated: 2025-12-16 14:32
VLAI?
Title
vmw_balloon: indicate success when effectively deflating during migration
Summary
In the Linux kernel, the following vulnerability has been resolved: vmw_balloon: indicate success when effectively deflating during migration When migrating a balloon page, we first deflate the old page to then inflate the new page. However, if inflating the new page succeeded, we effectively deflated the old page, reducing the balloon size. In that case, the migration actually worked: similar to migrating+ immediately deflating the new page. The old page will be freed back to the buddy. Right now, the core will leave the page be marked as isolated (as we returned an error). When later trying to putback that page, we will run into the WARN_ON_ONCE() in balloon_page_putback(). That handling was changed in commit 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()"); before that change, we would have tolerated that way of handling it. To fix it, let's just return 0 in that case, making the core effectively just clear the "isolated" flag + freeing it back to the buddy as if the migration succeeded. Note that the new page will also get freed when the core puts the last reference. Note that this also makes it all be more consistent: we will no longer unisolate the page in the balloon driver while keeping it marked as being isolated in migration core. This was found by code inspection.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3544c4faccb8f0867bc65f8007ee70bfb5054305 , < aa05a044c5c2e147d726ac2fae1a97e0775eac11 (git)
Affected: 3544c4faccb8f0867bc65f8007ee70bfb5054305 , < 4ba5a8a7faa647ada8eae61a36517cf369f5bbe4 (git)
Create a notification for this product.
    Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.17.6 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_balloon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa05a044c5c2e147d726ac2fae1a97e0775eac11",
              "status": "affected",
              "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
              "versionType": "git"
            },
            {
              "lessThan": "4ba5a8a7faa647ada8eae61a36517cf369f5bbe4",
              "status": "affected",
              "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_balloon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmw_balloon: indicate success when effectively deflating during migration\n\nWhen migrating a balloon page, we first deflate the old page to then\ninflate the new page.\n\nHowever, if inflating the new page succeeded, we effectively deflated the\nold page, reducing the balloon size.\n\nIn that case, the migration actually worked: similar to migrating+\nimmediately deflating the new page.  The old page will be freed back to\nthe buddy.\n\nRight now, the core will leave the page be marked as isolated (as we\nreturned an error).  When later trying to putback that page, we will run\ninto the WARN_ON_ONCE() in balloon_page_putback().\n\nThat handling was changed in commit 3544c4faccb8 (\"mm/balloon_compaction:\nstop using __ClearPageMovable()\"); before that change, we would have\ntolerated that way of handling it.\n\nTo fix it, let\u0027s just return 0 in that case, making the core effectively\njust clear the \"isolated\" flag + freeing it back to the buddy as if the\nmigration succeeded.  Note that the new page will also get freed when the\ncore puts the last reference.\n\nNote that this also makes it all be more consistent: we will no longer\nunisolate the page in the balloon driver while keeping it marked as being\nisolated in migration core.\n\nThis was found by code inspection."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T14:32:15.430Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa05a044c5c2e147d726ac2fae1a97e0775eac11"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ba5a8a7faa647ada8eae61a36517cf369f5bbe4"
        }
      ],
      "title": "vmw_balloon: indicate success when effectively deflating during migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68248",
    "datePublished": "2025-12-16T14:32:15.430Z",
    "dateReserved": "2025-12-16T13:41:40.266Z",
    "dateUpdated": "2025-12-16T14:32:15.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68248\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T15:15:54.083\",\"lastModified\":\"2025-12-18T15:08:06.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvmw_balloon: indicate success when effectively deflating during migration\\n\\nWhen migrating a balloon page, we first deflate the old page to then\\ninflate the new page.\\n\\nHowever, if inflating the new page succeeded, we effectively deflated the\\nold page, reducing the balloon size.\\n\\nIn that case, the migration actually worked: similar to migrating+\\nimmediately deflating the new page.  The old page will be freed back to\\nthe buddy.\\n\\nRight now, the core will leave the page be marked as isolated (as we\\nreturned an error).  When later trying to putback that page, we will run\\ninto the WARN_ON_ONCE() in balloon_page_putback().\\n\\nThat handling was changed in commit 3544c4faccb8 (\\\"mm/balloon_compaction:\\nstop using __ClearPageMovable()\\\"); before that change, we would have\\ntolerated that way of handling it.\\n\\nTo fix it, let\u0027s just return 0 in that case, making the core effectively\\njust clear the \\\"isolated\\\" flag + freeing it back to the buddy as if the\\nmigration succeeded.  Note that the new page will also get freed when the\\ncore puts the last reference.\\n\\nNote that this also makes it all be more consistent: we will no longer\\nunisolate the page in the balloon driver while keeping it marked as being\\nisolated in migration core.\\n\\nThis was found by code inspection.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4ba5a8a7faa647ada8eae61a36517cf369f5bbe4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa05a044c5c2e147d726ac2fae1a97e0775eac11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.