CVE-2025-68248 (GCVE-0-2025-68248)
Vulnerability from cvelistv5
Published
2025-12-16 14:32
Modified
2025-12-16 14:32
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: vmw_balloon: indicate success when effectively deflating during migration When migrating a balloon page, we first deflate the old page to then inflate the new page. However, if inflating the new page succeeded, we effectively deflated the old page, reducing the balloon size. In that case, the migration actually worked: similar to migrating+ immediately deflating the new page. The old page will be freed back to the buddy. Right now, the core will leave the page be marked as isolated (as we returned an error). When later trying to putback that page, we will run into the WARN_ON_ONCE() in balloon_page_putback(). That handling was changed in commit 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()"); before that change, we would have tolerated that way of handling it. To fix it, let's just return 0 in that case, making the core effectively just clear the "isolated" flag + freeing it back to the buddy as if the migration succeeded. Note that the new page will also get freed when the core puts the last reference. Note that this also makes it all be more consistent: we will no longer unisolate the page in the balloon driver while keeping it marked as being isolated in migration core. This was found by code inspection.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3544c4faccb8f0867bc65f8007ee70bfb5054305
Version: 3544c4faccb8f0867bc65f8007ee70bfb5054305
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_balloon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa05a044c5c2e147d726ac2fae1a97e0775eac11",
              "status": "affected",
              "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
              "versionType": "git"
            },
            {
              "lessThan": "4ba5a8a7faa647ada8eae61a36517cf369f5bbe4",
              "status": "affected",
              "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_balloon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmw_balloon: indicate success when effectively deflating during migration\n\nWhen migrating a balloon page, we first deflate the old page to then\ninflate the new page.\n\nHowever, if inflating the new page succeeded, we effectively deflated the\nold page, reducing the balloon size.\n\nIn that case, the migration actually worked: similar to migrating+\nimmediately deflating the new page.  The old page will be freed back to\nthe buddy.\n\nRight now, the core will leave the page be marked as isolated (as we\nreturned an error).  When later trying to putback that page, we will run\ninto the WARN_ON_ONCE() in balloon_page_putback().\n\nThat handling was changed in commit 3544c4faccb8 (\"mm/balloon_compaction:\nstop using __ClearPageMovable()\"); before that change, we would have\ntolerated that way of handling it.\n\nTo fix it, let\u0027s just return 0 in that case, making the core effectively\njust clear the \"isolated\" flag + freeing it back to the buddy as if the\nmigration succeeded.  Note that the new page will also get freed when the\ncore puts the last reference.\n\nNote that this also makes it all be more consistent: we will no longer\nunisolate the page in the balloon driver while keeping it marked as being\nisolated in migration core.\n\nThis was found by code inspection."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T14:32:15.430Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa05a044c5c2e147d726ac2fae1a97e0775eac11"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ba5a8a7faa647ada8eae61a36517cf369f5bbe4"
        }
      ],
      "title": "vmw_balloon: indicate success when effectively deflating during migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68248",
    "datePublished": "2025-12-16T14:32:15.430Z",
    "dateReserved": "2025-12-16T13:41:40.266Z",
    "dateUpdated": "2025-12-16T14:32:15.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68248\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T15:15:54.083\",\"lastModified\":\"2025-12-18T15:08:06.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvmw_balloon: indicate success when effectively deflating during migration\\n\\nWhen migrating a balloon page, we first deflate the old page to then\\ninflate the new page.\\n\\nHowever, if inflating the new page succeeded, we effectively deflated the\\nold page, reducing the balloon size.\\n\\nIn that case, the migration actually worked: similar to migrating+\\nimmediately deflating the new page.  The old page will be freed back to\\nthe buddy.\\n\\nRight now, the core will leave the page be marked as isolated (as we\\nreturned an error).  When later trying to putback that page, we will run\\ninto the WARN_ON_ONCE() in balloon_page_putback().\\n\\nThat handling was changed in commit 3544c4faccb8 (\\\"mm/balloon_compaction:\\nstop using __ClearPageMovable()\\\"); before that change, we would have\\ntolerated that way of handling it.\\n\\nTo fix it, let\u0027s just return 0 in that case, making the core effectively\\njust clear the \\\"isolated\\\" flag + freeing it back to the buddy as if the\\nmigration succeeded.  Note that the new page will also get freed when the\\ncore puts the last reference.\\n\\nNote that this also makes it all be more consistent: we will no longer\\nunisolate the page in the balloon driver while keeping it marked as being\\nisolated in migration core.\\n\\nThis was found by code inspection.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4ba5a8a7faa647ada8eae61a36517cf369f5bbe4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aa05a044c5c2e147d726ac2fae1a97e0775eac11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.