CVE-2025-39844 (GCVE-0-2025-39844)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:26 – Updated: 2026-05-12 12:07
VLAI
Title
mm: move page table sync declarations to linux/pgtable.h
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: <TASK> __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] </TASK> It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 ("x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6843 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8d400913c231bd1da74067255816453f96cd35b0 , < 732e62212f49d549c91071b4da7942ee3058f7a2 (git)
Affected: 8d400913c231bd1da74067255816453f96cd35b0 , < eceb44e1f94bd641b2a4e8c09b64c797c4eabc15 (git)
Affected: 8d400913c231bd1da74067255816453f96cd35b0 , < 6797a8b3f71b2cb558b8771a03450dc3e004e453 (git)
Affected: 8d400913c231bd1da74067255816453f96cd35b0 , < 4f7537772011fad832f83d6848f8eab282545bef (git)
Affected: 8d400913c231bd1da74067255816453f96cd35b0 , < 469f9d22751472b81eaaf8a27fcdb5a70741c342 (git)
Affected: 8d400913c231bd1da74067255816453f96cd35b0 , < 7cc183f2e67d19b03ee5c13a6664b8c6cc37ff9d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.192 , ≤ 5.15.* (semver)
Unaffected: 6.1.151 , ≤ 6.1.* (semver)
Unaffected: 6.6.105 , ≤ 6.6.* (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.16.6 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:59.901Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:32.370Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/pgtable.h",
            "include/linux/vmalloc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "732e62212f49d549c91071b4da7942ee3058f7a2",
              "status": "affected",
              "version": "8d400913c231bd1da74067255816453f96cd35b0",
              "versionType": "git"
            },
            {
              "lessThan": "eceb44e1f94bd641b2a4e8c09b64c797c4eabc15",
              "status": "affected",
              "version": "8d400913c231bd1da74067255816453f96cd35b0",
              "versionType": "git"
            },
            {
              "lessThan": "6797a8b3f71b2cb558b8771a03450dc3e004e453",
              "status": "affected",
              "version": "8d400913c231bd1da74067255816453f96cd35b0",
              "versionType": "git"
            },
            {
              "lessThan": "4f7537772011fad832f83d6848f8eab282545bef",
              "status": "affected",
              "version": "8d400913c231bd1da74067255816453f96cd35b0",
              "versionType": "git"
            },
            {
              "lessThan": "469f9d22751472b81eaaf8a27fcdb5a70741c342",
              "status": "affected",
              "version": "8d400913c231bd1da74067255816453f96cd35b0",
              "versionType": "git"
            },
            {
              "lessThan": "7cc183f2e67d19b03ee5c13a6664b8c6cc37ff9d",
              "status": "affected",
              "version": "8d400913c231bd1da74067255816453f96cd35b0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/pgtable.h",
            "include/linux/vmalloc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.151",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: move page table sync declarations to linux/pgtable.h\n\nDuring our internal testing, we started observing intermittent boot\nfailures when the machine uses 4-level paging and has a large amount of\npersistent memory:\n\n  BUG: unable to handle page fault for address: ffffe70000000034\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 0 P4D 0 \n  Oops: 0002 [#1] SMP NOPTI\n  RIP: 0010:__init_single_page+0x9/0x6d\n  Call Trace:\n   \u003cTASK\u003e\n   __init_zone_device_page+0x17/0x5d\n   memmap_init_zone_device+0x154/0x1bb\n   pagemap_range+0x2e0/0x40f\n   memremap_pages+0x10b/0x2f0\n   devm_memremap_pages+0x1e/0x60\n   dev_dax_probe+0xce/0x2ec [device_dax]\n   dax_bus_probe+0x6d/0xc9\n   [... snip ...]\n   \u003c/TASK\u003e\n\nIt turns out that the kernel panics while initializing vmemmap (struct\npage array) when the vmemmap region spans two PGD entries, because the new\nPGD entry is only installed in init_mm.pgd, but not in the page tables of\nother tasks.\n\nAnd looking at __populate_section_memmap():\n  if (vmemmap_can_optimize(altmap, pgmap))                                \n          // does not sync top level page tables\n          r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap);\n  else                                                                    \n          // sync top level page tables in x86\n          r = vmemmap_populate(start, end, nid, altmap);\n\nIn the normal path, vmemmap_populate() in arch/x86/mm/init_64.c\nsynchronizes the top level page table (See commit 9b861528a801 (\"x86-64,\nmem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so\nthat all tasks in the system can see the new vmemmap area.\n\nHowever, when vmemmap_can_optimize() returns true, the optimized path\nskips synchronization of top-level page tables.  This is because\nvmemmap_populate_compound_pages() is implemented in core MM code, which\ndoes not handle synchronization of the top-level page tables.  Instead,\nthe core MM has historically relied on each architecture to perform this\nsynchronization manually.\n\nWe\u0027re not the first party to encounter a crash caused by not-sync\u0027d top\nlevel page tables: earlier this year, Gwan-gyeong Mun attempted to address\nthe issue [1] [2] after hitting a kernel panic when x86 code accessed the\nvmemmap area before the corresponding top-level entries were synced.  At\nthat time, the issue was believed to be triggered only when struct page\nwas enlarged for debugging purposes, and the patch did not get further\nupdates.\n\nIt turns out that current approach of relying on each arch to handle the\npage table sync manually is fragile because 1) it\u0027s easy to forget to sync\nthe top level page table, and 2) it\u0027s also easy to overlook that the\nkernel should not access the vmemmap and direct mapping areas before the\nsync.\n\n# The solution: Make page table sync more code robust and harder to miss\n\nTo address this, Dave Hansen suggested [3] [4] introducing\n{pgd,p4d}_populate_kernel() for updating kernel portion of the page tables\nand allow each architecture to explicitly perform synchronization when\ninstalling top-level entries.  With this approach, we no longer need to\nworry about missing the sync step, reducing the risk of future\nregressions.\n\nThe new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK,\nPGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by\nvmalloc and ioremap to synchronize page tables.\n\npgd_populate_kernel() looks like this:\nstatic inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd,\n                                       p4d_t *p4d)\n{\n        pgd_populate(\u0026init_mm, pgd, p4d);\n        if (ARCH_PAGE_TABLE_SYNC_MASK \u0026 PGTBL_PGD_MODIFIED)\n                arch_sync_kernel_mappings(addr, addr);\n}\n\nIt is worth noting that vmalloc() and apply_to_range() carefully\nsynchronizes page tables by calling p*d_alloc_track() and\narch_sync_kernel_mappings(), and thus they are not affected by\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:37:32.267Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/732e62212f49d549c91071b4da7942ee3058f7a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/eceb44e1f94bd641b2a4e8c09b64c797c4eabc15"
        },
        {
          "url": "https://git.kernel.org/stable/c/6797a8b3f71b2cb558b8771a03450dc3e004e453"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f7537772011fad832f83d6848f8eab282545bef"
        },
        {
          "url": "https://git.kernel.org/stable/c/469f9d22751472b81eaaf8a27fcdb5a70741c342"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cc183f2e67d19b03ee5c13a6664b8c6cc37ff9d"
        }
      ],
      "title": "mm: move page table sync declarations to linux/pgtable.h",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39844",
    "datePublished": "2025-09-19T15:26:18.471Z",
    "dateReserved": "2025-04-16T07:20:57.141Z",
    "dateUpdated": "2026-05-12T12:07:32.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39844",
      "date": "2026-10-21",
      "epss": "0.0015",
      "percentile": "0.03832"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:42:08.000Z",
      "cve": "CVE-2025-39844",
      "id": "msrc_CVE-2025-39844",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm: move page table sync declarations to linux/pgtable.h",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39844.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/pgtable.h",
                  "include/linux/vmalloc.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "732e62212f49d549c91071b4da7942ee3058f7a2",
                    "status": "affected",
                    "version": "8d400913c231bd1da74067255816453f96cd35b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eceb44e1f94bd641b2a4e8c09b64c797c4eabc15",
                    "status": "affected",
                    "version": "8d400913c231bd1da74067255816453f96cd35b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6797a8b3f71b2cb558b8771a03450dc3e004e453",
                    "status": "affected",
                    "version": "8d400913c231bd1da74067255816453f96cd35b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f7537772011fad832f83d6848f8eab282545bef",
                    "status": "affected",
                    "version": "8d400913c231bd1da74067255816453f96cd35b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "469f9d22751472b81eaaf8a27fcdb5a70741c342",
                    "status": "affected",
                    "version": "8d400913c231bd1da74067255816453f96cd35b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7cc183f2e67d19b03ee5c13a6664b8c6cc37ff9d",
                    "status": "affected",
                    "version": "8d400913c231bd1da74067255816453f96cd35b0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/pgtable.h",
                  "include/linux/vmalloc.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.13"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.192",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC CN 4100",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V5.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58184035-CB3D-4BC2-B2F2-3ECF469A82CE",
                    "versionEndExcluding": "5.15.192",
                    "versionStartIncluding": "5.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BC2D0B88-F133-4143-B91D-0A439AA143C0",
                    "versionEndExcluding": "6.1.151",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B9364B0C-6B18-422E-8254-73EF0E856875",
                    "versionEndExcluding": "6.6.105",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F7E2B332-E920-4CAC-B400-288602DB6F16",
                    "versionEndExcluding": "6.12.46",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "548F104C-0F08-438B-9C97-64C903F0C678",
                    "versionEndExcluding": "6.16.6",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: move page table sync declarations to linux/pgtable.h\n\nDuring our internal testing, we started observing intermittent boot\nfailures when the machine uses 4-level paging and has a large amount of\npersistent memory:\n\n  BUG: unable to handle page fault for address: ffffe70000000034\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 0 P4D 0 \n  Oops: 0002 [#1] SMP NOPTI\n  RIP: 0010:__init_single_page+0x9/0x6d\n  Call Trace:\n   \u003cTASK\u003e\n   __init_zone_device_page+0x17/0x5d\n   memmap_init_zone_device+0x154/0x1bb\n   pagemap_range+0x2e0/0x40f\n   memremap_pages+0x10b/0x2f0\n   devm_memremap_pages+0x1e/0x60\n   dev_dax_probe+0xce/0x2ec [device_dax]\n   dax_bus_probe+0x6d/0xc9\n   [... snip ...]\n   \u003c/TASK\u003e\n\nIt turns out that the kernel panics while initializing vmemmap (struct\npage array) when the vmemmap region spans two PGD entries, because the new\nPGD entry is only installed in init_mm.pgd, but not in the page tables of\nother tasks.\n\nAnd looking at __populate_section_memmap():\n  if (vmemmap_can_optimize(altmap, pgmap))                                \n          // does not sync top level page tables\n          r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap);\n  else                                                                    \n          // sync top level page tables in x86\n          r = vmemmap_populate(start, end, nid, altmap);\n\nIn the normal path, vmemmap_populate() in arch/x86/mm/init_64.c\nsynchronizes the top level page table (See commit 9b861528a801 (\"x86-64,\nmem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so\nthat all tasks in the system can see the new vmemmap area.\n\nHowever, when vmemmap_can_optimize() returns true, the optimized path\nskips synchronization of top-level page tables.  This is because\nvmemmap_populate_compound_pages() is implemented in core MM code, which\ndoes not handle synchronization of the top-level page tables.  Instead,\nthe core MM has historically relied on each architecture to perform this\nsynchronization manually.\n\nWe\u0027re not the first party to encounter a crash caused by not-sync\u0027d top\nlevel page tables: earlier this year, Gwan-gyeong Mun attempted to address\nthe issue [1] [2] after hitting a kernel panic when x86 code accessed the\nvmemmap area before the corresponding top-level entries were synced.  At\nthat time, the issue was believed to be triggered only when struct page\nwas enlarged for debugging purposes, and the patch did not get further\nupdates.\n\nIt turns out that current approach of relying on each arch to handle the\npage table sync manually is fragile because 1) it\u0027s easy to forget to sync\nthe top level page table, and 2) it\u0027s also easy to overlook that the\nkernel should not access the vmemmap and direct mapping areas before the\nsync.\n\n# The solution: Make page table sync more code robust and harder to miss\n\nTo address this, Dave Hansen suggested [3] [4] introducing\n{pgd,p4d}_populate_kernel() for updating kernel portion of the page tables\nand allow each architecture to explicitly perform synchronization when\ninstalling top-level entries.  With this approach, we no longer need to\nworry about missing the sync step, reducing the risk of future\nregressions.\n\nThe new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK,\nPGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by\nvmalloc and ioremap to synchronize page tables.\n\npgd_populate_kernel() looks like this:\nstatic inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd,\n                                       p4d_t *p4d)\n{\n        pgd_populate(\u0026init_mm, pgd, p4d);\n        if (ARCH_PAGE_TABLE_SYNC_MASK \u0026 PGTBL_PGD_MODIFIED)\n                arch_sync_kernel_mappings(addr, addr);\n}\n\nIt is worth noting that vmalloc() and apply_to_range() carefully\nsynchronizes page tables by calling p*d_alloc_track() and\narch_sync_kernel_mappings(), and thus they are not affected by\n---truncated---"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm: mover las declaraciones de sincronizaci\u00f3n de tablas de p\u00e1ginas a linux/pgtable.h\n\nDurante nuestras pruebas internas, comenzamos a observar fallos de arranque intermitentes cuando la m\u00e1quina utiliza paginaci\u00f3n de 4 niveles y tiene una gran cantidad de memoria persistente:\n\n  BUG: incapaz de manejar fallo de p\u00e1gina para la direcci\u00f3n: ffffe70000000034\n  #PF: acceso de escritura de supervisor en modo kernel\n  #PF: c\u00f3digo_de_error(0x0002) - p\u00e1gina no presente\n  PGD 0 P4D 0\n  Oops: 0002 [#1] SMP NOPTI\n  RIP: 0010:__init_single_page+0x9/0x6d\n  Call Trace:\n   \u003cTASK\u003e\n   __init_zone_device_page+0x17/0x5d\n   memmap_init_zone_device+0x154/0x1bb\n   pagemap_range+0x2e0/0x40f\n   memremap_pages+0x10b/0x2f0\n   devm_memremap_pages+0x1e/0x60\n   dev_dax_probe+0xce/0x2ec [device_dax]\n   dax_bus_probe+0x6d/0xc9\n   [... recortado ...]\n   \u003c/TASK\u003e\n\nResulta que el kernel entra en p\u00e1nico mientras inicializa vmemmap (array de struct page) cuando la regi\u00f3n vmemmap abarca dos entradas PGD, porque la nueva entrada PGD solo se instala en init_mm.pgd, pero no en las tablas de p\u00e1ginas de otras tareas.\n\nY mirando a __populate_section_memmap():\n  if (vmemmap_can_optimize(altmap, pgmap))\n          // no sincroniza las tablas de p\u00e1ginas de nivel superior\n          r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap);\n  else\n          // sincroniza las tablas de p\u00e1ginas de nivel superior en x86\n          r = vmemmap_populate(start, end, nid, altmap);\n\nEn la ruta normal, vmemmap_populate() en arch/x86/mm/init_64.c sincroniza la tabla de p\u00e1ginas de nivel superior (Ver commit 9b861528a801 (\u0027x86-64, mem: Actualizar todos los PGD para mapeo directo y cambios de mapeo de vmemmap\u0027)) para que todas las tareas en el sistema puedan ver la nueva \u00e1rea vmemmap.\n\nSin embargo, cuando vmemmap_can_optimize() devuelve verdadero, la ruta optimizada omite la sincronizaci\u00f3n de las tablas de p\u00e1ginas de nivel superior. Esto se debe a que vmemmap_populate_compound_pages() est\u00e1 implementado en el c\u00f3digo MM central, el cual no maneja la sincronizaci\u00f3n de las tablas de p\u00e1ginas de nivel superior. En cambio, el MM central ha dependido hist\u00f3ricamente de cada arquitectura para realizar esta sincronizaci\u00f3n manualmente.\n\nNo somos la primera parte en encontrar un fallo causado por tablas de p\u00e1ginas de nivel superior no sincronizadas: a principios de este a\u00f1o, Gwan-gyeong Mun intent\u00f3 abordar el problema [1] [2] despu\u00e9s de experimentar un p\u00e1nico del kernel cuando el c\u00f3digo x86 accedi\u00f3 al \u00e1rea vmemmap antes de que las entradas de nivel superior correspondientes fueran sincronizadas. En ese momento, se cre\u00eda que el problema se activaba solo cuando la estructura de p\u00e1gina (struct page) se ampliaba con fines de depuraci\u00f3n, y el parche no recibi\u00f3 m\u00e1s actualizaciones.\n\nResulta que el enfoque actual de depender de cada arquitectura para manejar la sincronizaci\u00f3n manual de la tabla de p\u00e1ginas es fr\u00e1gil porque 1) es f\u00e1cil olvidar sincronizar la tabla de p\u00e1ginas de nivel superior, y 2) tambi\u00e9n es f\u00e1cil pasar por alto que el kernel no debe acceder a las \u00e1reas vmemmap y de mapeo directo antes de la sincronizaci\u00f3n.\n\n# La soluci\u00f3n: Hacer que la sincronizaci\u00f3n de la tabla de p\u00e1ginas sea m\u00e1s robusta en el c\u00f3digo y m\u00e1s dif\u00edcil de pasar por alto\n\nPara abordar esto, Dave Hansen sugiri\u00f3 [3] [4] introducir {pgd,p4d}_populate_kernel() para actualizar la porci\u00f3n del kernel de las tablas de p\u00e1ginas y permitir que cada arquitectura realice expl\u00edcitamente la sincronizaci\u00f3n al instalar entradas de nivel superior. Con este enfoque, ya no necesitamos preocuparnos por omitir el paso de sincronizaci\u00f3n, reduciendo el riesgo de futuras regresiones.\n\nLa nueva interfaz reutiliza la facilidad existente ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED y arch_sync_kernel_mappings() utilizada por vmalloc y ioremap para sincronizar tablas de p\u00e1ginas.\n\npgd_populate_kernel() se ve as\u00ed:\nstatic inline void --TRUNCADO--"
          }
        ],
        "id": "CVE-2025-39844",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-19T16:15:43.160",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/469f9d22751472b81eaaf8a27fcdb5a70741c342"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f7537772011fad832f83d6848f8eab282545bef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6797a8b3f71b2cb558b8771a03450dc3e004e453"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/732e62212f49d549c91071b4da7942ee3058f7a2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7cc183f2e67d19b03ee5c13a6664b8c6cc37ff9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eceb44e1f94bd641b2a4e8c09b64c797c4eabc15"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:27:13+00:00",
      "cve": "CVE-2025-39844",
      "id": "CVE-2025-39844",
      "initial_release_date": "2025-09-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: move page table sync declarations to linux/pgtable.h",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39844.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-15T16:32:24Z",
      "cve": "CVE-2025-39844",
      "id": "CVE-2025-39844",
      "initial_release_date": "2025-09-19T23:24:02Z",
      "product_status:known_affected": "527",
      "product_status:known_not_affected": "262",
      "product_status:recommended": "495",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39844",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2025/cve-2025-39844.json",
      "version": "54"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.