{"id":"CVE-2025-39883","state":"PUBLISHED","title":"mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory\n\nWhen I did memory failure tests, below panic occurs:\n\npage dumped because: VM_BUG_ON_PAGE(PagePoisoned(page))\nkernel BUG at include/linux/page-flags.h:616!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 720 Comm: bash Not tainted 6.10.0-rc1-00195-g148743902568 #40\nRIP: 0010:unpoison_memory+0x2f3/0x590\nRSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246\nRAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8\nRDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0\nRBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb\nR10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000\nR13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe\nFS:  00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0\nCall Trace:\n <TASK>\n unpoison_memory+0x2f3/0x590\n simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110\n debugfs_attr_write+0x42/0x60\n full_proxy_write+0x5b/0x80\n vfs_write+0xd5/0x540\n ksys_write+0x64/0xe0\n do_syscall_64+0xb9/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f08f0314887\nRSP: 002b:00007ffece710078 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f08f0314887\nRDX: 0000000000000009 RSI: 0000564787a30410 RDI: 0000000000000001\nRBP: 0000564787a30410 R08: 000000000000fefe R09: 000000007fffffff\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009\nR13: 00007f08f041b780 R14: 00007f08f0417600 R15: 00007f08f0416a00\n </TASK>\nModules linked in: hwpoison_inject\n---[ end trace 0000000000000000 ]---\nRIP: 0010:unpoison_memory+0x2f3/0x590\nRSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246\nRAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8\nRDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0\nRBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb\nR10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000\nR13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe\nFS:  00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0\nKernel panic - not syncing: Fatal exception\nKernel Offset: 0x31c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)\n---[ end Kernel panic - not syncing: Fatal exception ]---\n\nThe root cause is that unpoison_memory() tries to check the PG_HWPoison\nflags of an uninitialized page.  So VM_BUG_ON_PAGE(PagePoisoned(page)) is\ntriggered.  This can be reproduced by below steps:\n\n1.Offline memory block:\n\n echo offline > /sys/devices/system/memory/memory12/state\n\n2.Get offlined memory pfn:\n\n page-types -b n -rlN\n\n3.Write pfn to unpoison-pfn\n\n echo <pfn> > /sys/kernel/debug/hwpoison/unpoison-pfn\n\nThis scenario can be identified by pfn_to_online_page() returning NULL. \nAnd ZONE_DEVICE pages are never expected, so we can simply fail if\npfn_to_online_page() == NULL to fix the bug.","publishedAt":"2025-09-23T06:00:51.548Z","updatedAt":"2026-06-11T18:44:14.568Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"8e01ea186a52c90694c08a9ff57bea1b0e78256a","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"fb65803ccff37cf9123c50c1c02efd1ed73c4ed5","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"99f7048957f5ae3cee1c01189147e73a9a96de02","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"e4ec6def5643a1c9511115b3884eb879572294c6","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"3d278e89c2ea62b1aaa4b0d8a9766a35b3a3164a","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"7618fd443aa4cfa553a64cacf5721581653ee7b0","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"63a327a2375a8ce7a47dec5aaa4d8a9ae0a00b96","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"d613f53c83ec47089c4e25859d5e8e0359f6f8da","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/memory-failure.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.13","versionType":"semver"},{"version":"5.4.300","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.245","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.194","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.153","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.107","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.48","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.8","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/memory-failure.c"]}],"references":["https://git.kernel.org/stable/c/8e01ea186a52c90694c08a9ff57bea1b0e78256a","https://git.kernel.org/stable/c/fb65803ccff37cf9123c50c1c02efd1ed73c4ed5","https://git.kernel.org/stable/c/99f7048957f5ae3cee1c01189147e73a9a96de02","https://git.kernel.org/stable/c/e4ec6def5643a1c9511115b3884eb879572294c6","https://git.kernel.org/stable/c/3d278e89c2ea62b1aaa4b0d8a9766a35b3a3164a","https://git.kernel.org/stable/c/7618fd443aa4cfa553a64cacf5721581653ee7b0","https://git.kernel.org/stable/c/63a327a2375a8ce7a47dec5aaa4d8a9ae0a00b96","https://git.kernel.org/stable/c/d613f53c83ec47089c4e25859d5e8e0359f6f8da","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39883.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39883","state":"PUBLISHED","datePublished":"2025-09-23T06:00:51.548Z","dateUpdated":"2026-06-11T18:44:14.568Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.144Z"},"containers":{"cna":{"title":"mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory\n\nWhen I did memory failure tests, below panic occurs:\n\npage dumped because: VM_BUG_ON_PAGE(PagePoisoned(page))\nkernel BUG at include/linux/page-flags.h:616!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 720 Comm: bash Not tainted 6.10.0-rc1-00195-g148743902568 #40\nRIP: 0010:unpoison_memory+0x2f3/0x590\nRSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246\nRAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8\nRDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0\nRBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb\nR10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000\nR13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe\nFS:  00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0\nCall Trace:\n <TASK>\n unpoison_memory+0x2f3/0x590\n simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110\n debugfs_attr_write+0x42/0x60\n full_proxy_write+0x5b/0x80\n vfs_write+0xd5/0x540\n ksys_write+0x64/0xe0\n do_syscall_64+0xb9/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f08f0314887\nRSP: 002b:00007ffece710078 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f08f0314887\nRDX: 0000000000000009 RSI: 0000564787a30410 RDI: 0000000000000001\nRBP: 0000564787a30410 R08: 000000000000fefe R09: 000000007fffffff\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009\nR13: 00007f08f041b780 R14: 00007f08f0417600 R15: 00007f08f0416a00\n </TASK>\nModules linked in: hwpoison_inject\n---[ end trace 0000000000000000 ]---\nRIP: 0010:unpoison_memory+0x2f3/0x590\nRSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246\nRAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8\nRDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0\nRBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb\nR10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000\nR13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe\nFS:  00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0\nKernel panic - not syncing: Fatal exception\nKernel Offset: 0x31c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)\n---[ end Kernel panic - not syncing: Fatal exception ]---\n\nThe root cause is that unpoison_memory() tries to check the PG_HWPoison\nflags of an uninitialized page.  So VM_BUG_ON_PAGE(PagePoisoned(page)) is\ntriggered.  This can be reproduced by below steps:\n\n1.Offline memory block:\n\n echo offline > /sys/devices/system/memory/memory12/state\n\n2.Get offlined memory pfn:\n\n page-types -b n -rlN\n\n3.Write pfn to unpoison-pfn\n\n echo <pfn> > /sys/kernel/debug/hwpoison/unpoison-pfn\n\nThis scenario can be identified by pfn_to_online_page() returning NULL. \nAnd ZONE_DEVICE pages are never expected, so we can simply fail if\npfn_to_online_page() == NULL to fix the bug."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"8e01ea186a52c90694c08a9ff57bea1b0e78256a","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"fb65803ccff37cf9123c50c1c02efd1ed73c4ed5","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"99f7048957f5ae3cee1c01189147e73a9a96de02","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"e4ec6def5643a1c9511115b3884eb879572294c6","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"3d278e89c2ea62b1aaa4b0d8a9766a35b3a3164a","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"7618fd443aa4cfa553a64cacf5721581653ee7b0","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"63a327a2375a8ce7a47dec5aaa4d8a9ae0a00b96","versionType":"git"},{"version":"f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe","status":"affected","lessThan":"d613f53c83ec47089c4e25859d5e8e0359f6f8da","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/memory-failure.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.13","versionType":"semver"},{"version":"5.4.300","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.245","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.194","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.153","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.107","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.48","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.8","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/memory-failure.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/8e01ea186a52c90694c08a9ff57bea1b0e78256a"},{"url":"https://git.kernel.org/stable/c/fb65803ccff37cf9123c50c1c02efd1ed73c4ed5"},{"url":"https://git.kernel.org/stable/c/99f7048957f5ae3cee1c01189147e73a9a96de02"},{"url":"https://git.kernel.org/stable/c/e4ec6def5643a1c9511115b3884eb879572294c6"},{"url":"https://git.kernel.org/stable/c/3d278e89c2ea62b1aaa4b0d8a9766a35b3a3164a"},{"url":"https://git.kernel.org/stable/c/7618fd443aa4cfa553a64cacf5721581653ee7b0"},{"url":"https://git.kernel.org/stable/c/63a327a2375a8ce7a47dec5aaa4d8a9ae0a00b96"},{"url":"https://git.kernel.org/stable/c/d613f53c83ec47089c4e25859d5e8e0359f6f8da"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T21:38:16.305Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.4.300"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.10.245"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.15.194"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.1.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.6.107"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.12.48"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.16.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:44:24.900Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-39883","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T20:41:38.238559Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-11T18:44:14.568Z"}}]}}}