CVE-2025-40270 (GCVE-0-2025-40270)

Vulnerability from cvelistv5 – Published: 2025-12-06 21:50 – Updated: 2026-08-05 12:09
VLAI
Title
mm, swap: fix potential UAF issue for VMA readahead
Summary
In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix potential UAF issue for VMA readahead Since commit 78524b05f1a3 ("mm, swap: avoid redundant swap device pinning"), the common helper for allocating and preparing a folio in the swap cache layer no longer tries to get a swap device reference internally, because all callers of __read_swap_cache_async are already holding a swap entry reference. The repeated swap device pinning isn't needed on the same swap device. Caller of VMA readahead is also holding a reference to the target entry's swap device, but VMA readahead walks the page table, so it might encounter swap entries from other devices, and call __read_swap_cache_async on another device without holding a reference to it. So it is possible to cause a UAF when swapoff of device A raced with swapin on device B, and VMA readahead tries to read swap entries from device A. It's not easy to trigger, but in theory, it could cause real issues. Make VMA readahead try to get the device reference first if the swap device is a different one from the target entry.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 78524b05f1a3e16a5d00cc9c6259c41a9d6003ce , < a4145be7b56bfa87dce56415c3ad993071462b8a (git)
Affected: 78524b05f1a3e16a5d00cc9c6259c41a9d6003ce , < 1c2a936edd71e133f2806e68324ec81a4eb07588 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.17.9 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/swap_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a4145be7b56bfa87dce56415c3ad993071462b8a",
              "status": "affected",
              "version": "78524b05f1a3e16a5d00cc9c6259c41a9d6003ce",
              "versionType": "git"
            },
            {
              "lessThan": "1c2a936edd71e133f2806e68324ec81a4eb07588",
              "status": "affected",
              "version": "78524b05f1a3e16a5d00cc9c6259c41a9d6003ce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/swap_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, swap: fix potential UAF issue for VMA readahead\n\nSince commit 78524b05f1a3 (\"mm, swap: avoid redundant swap device\npinning\"), the common helper for allocating and preparing a folio in the\nswap cache layer no longer tries to get a swap device reference\ninternally, because all callers of __read_swap_cache_async are already\nholding a swap entry reference.  The repeated swap device pinning isn\u0027t\nneeded on the same swap device.\n\nCaller of VMA readahead is also holding a reference to the target entry\u0027s\nswap device, but VMA readahead walks the page table, so it might encounter\nswap entries from other devices, and call __read_swap_cache_async on\nanother device without holding a reference to it.\n\nSo it is possible to cause a UAF when swapoff of device A raced with\nswapin on device B, and VMA readahead tries to read swap entries from\ndevice A.  It\u0027s not easy to trigger, but in theory, it could cause real\nissues.\n\nMake VMA readahead try to get the device reference first if the swap\ndevice is a different one from the target entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached purely through local memory operations \u2014 an ordinary page fault on a swapped-out anonymous page (`do_swap_page` \u2192 `swapin_readahead` \u2192 `swap_vma_readahead`), with swap PTEs placed on demand via `madvise(MADV_PAGEOUT)`. No network or remote-peer data is involved.\nAC:L - The attacker fully owns and can indefinitely retry the swapin side \u2014 unlimited faulting threads over regions deliberately paged out across multiple swap devices \u2014 and can hold the window open through the `SWAP_HAS_CACHE` contention path in `__read_swap_cache_async()`, whose `schedule_timeout_uninterruptible(1)` retry loop re-dereferences the stale `si-\u003ecluster_info` after each sleep; no attacker-unknowable memory layout is required. The only element not directly issued by the attacker is `swapoff(2)`, which is a routine, repeatable system event (hibernate, `swapoff -a`, zram/swapfile reconfiguration) that a resident exploit simply waits for.\nPR:L - The attacker-controlled half of the race needs nothing beyond an ordinary unprivileged local account: `mmap`, `madvise(MADV_PAGEOUT)` and touching the memory are unrestricted, and `swap_vma_readahead()` has no capability check on any part of its path.\nUI:N - The attacker drives the faulting/readahead side entirely from its own threads with no victim cooperation; the concurrent swapoff is normal unattended system activity (hibernation, maintenance, swap reconfiguration), not an action solicited from a user.\nS:U - The corruption is confined to kernel data structures (`swap_info_struct::cluster_info`, `swap_map`, swap-table pages) managed by the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `swap_table_get()` follows a `ci-\u003etable` pointer read out of the kvfree\u0027d `cluster_info` array and `swp_tb_to_folio()` casts the resulting value straight to `struct folio *`, which `do_swap_page()` then maps into the faulting process\u0027s page tables \u2014 once the freed allocation is reclaimed with groomed content this yields disclosure of arbitrary kernel/physical memory into userspace.\nI:H - `swap_cluster_lock()` performs `spin_lock(\u0026ci-\u003elock)`, a write into the freed cluster array, at an offset that is no longer bounds-checked because the dropped `get_swap_device()` also carried the `offset \u003e= si-\u003emax` validation; combined with `folio_try_get()` incrementing a refcount at an attacker-influenced address and mapping a fabricated folio into the process, this provides write primitives suitable for local privilege escalation.\nA:H - Swapoff clears `si-\u003ecluster_info`, `si-\u003eswap_map` and `si-\u003emax` to NULL/0 after freeing them, so the racing readahead dereferences freed or NULL pointers inside the page-fault path, producing a kernel oops/panic, and the race can be re-run continuously."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:03.442Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a4145be7b56bfa87dce56415c3ad993071462b8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c2a936edd71e133f2806e68324ec81a4eb07588"
        }
      ],
      "title": "mm, swap: fix potential UAF issue for VMA readahead",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40270",
    "datePublished": "2025-12-06T21:50:51.639Z",
    "dateReserved": "2025-04-16T07:20:57.183Z",
    "dateUpdated": "2026-08-05T12:09:03.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40270",
      "date": "2026-08-18",
      "epss": "0.00133",
      "percentile": "0.0328"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40270\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-06T22:15:54.610\",\"lastModified\":\"2026-07-30T06:24:24.607\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm, swap: fix potential UAF issue for VMA readahead\\n\\nSince commit 78524b05f1a3 (\\\"mm, swap: avoid redundant swap device\\npinning\\\"), the common helper for allocating and preparing a folio in the\\nswap cache layer no longer tries to get a swap device reference\\ninternally, because all callers of __read_swap_cache_async are already\\nholding a swap entry reference.  The repeated swap device pinning isn\u0027t\\nneeded on the same swap device.\\n\\nCaller of VMA readahead is also holding a reference to the target entry\u0027s\\nswap device, but VMA readahead walks the page table, so it might encounter\\nswap entries from other devices, and call __read_swap_cache_async on\\nanother device without holding a reference to it.\\n\\nSo it is possible to cause a UAF when swapoff of device A raced with\\nswapin on device B, and VMA readahead tries to read swap entries from\\ndevice A.  It\u0027s not easy to trigger, but in theory, it could cause real\\nissues.\\n\\nMake VMA readahead try to get the device reference first if the swap\\ndevice is a different one from the target entry.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/swap_state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"78524b05f1a3e16a5d00cc9c6259c41a9d6003ce\",\"lessThan\":\"a4145be7b56bfa87dce56415c3ad993071462b8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"78524b05f1a3e16a5d00cc9c6259c41a9d6003ce\",\"lessThan\":\"1c2a936edd71e133f2806e68324ec81a4eb07588\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/swap_state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.9\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1c2a936edd71e133f2806e68324ec81a4eb07588\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a4145be7b56bfa87dce56415c3ad993071462b8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:37:37+00:00",
      "cve": "CVE-2025-40270",
      "id": "CVE-2025-40270",
      "initial_release_date": "2025-12-06T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm, swap: fix potential UAF issue for VMA readahead",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40270.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:32:31Z",
      "cve": "CVE-2025-40270",
      "id": "CVE-2025-40270",
      "initial_release_date": "2025-12-08T00:23:23Z",
      "product_status:known_not_affected": "408",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40270",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40270.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.