Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-68231

mm/mempool: fix poisoning order>0 pages with HIGHMEM

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: mm/mempool: fix poisoning order>0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page *pde = 03171067 *pte = 00000000 Oops: Oops: 0002 [#1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17) Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56 EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287 CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690 Call Trace: poison_element (mm/mempool.c:83 mm/mempool.c:102) mempool_init_node (mm/mempool.c:142 mm/mempool.c:226) mempool_init_noprof (mm/mempool.c:250 (discriminator 1)) ? mempool_alloc_pages (mm/mempool.c:640) bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8)) ? mempool_alloc_pages (mm/mempool.c:640) do_one_initcall (init/main.c:1283) Christoph found out this is due to the poisoning code not dealing properly with CONFIG_HIGHMEM because only the first page is mapped but then the whole potentially high-order page is accessed. We could give up on HIGHMEM here, but it's straightforward to fix this with a loop that's mapping, poisoning or checking and unmapping individual pages.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 to < ea4131665107e66ece90e66bcec1a2f1246cbd41affected
  • bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 to < 19de79aaea33ee1ea058c8711b3b2b4a7e4decd4affected
  • bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 to < 6a13b56537e7b0d97f4bb74e8038ce471f9770d7affected
  • bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 to < a79e49e1704367b635edad1479db23d7cf1fb71aaffected
  • bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 to < ec33b59542d96830e3c89845ff833cf7b25ef172affected

Linux Linux

Default version status: affected

  • 4.1affected
  • 0 to < 4.1unaffected
  • 6.1.159 to ≤ 6.1.*unaffected
  • 6.6.118 to ≤ 6.6.*unaffected
  • 6.12.60 to ≤ 6.12.*unaffected
  • 6.17.10 to ≤ 6.17.*unaffected
  • 6.18 to ≤ *unaffected

References