CVE-2025-38050: mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios
A kernel crash was observed when replacing free hugetlb folios:
BUG: kernel NULL pointer dereference, address: 0000000000000028 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 28 UID: 0 PID: 29639 Comm: testcma.sh Tainted 6.15.0-rc6-zp #41 PREEMPT(voluntary) RIP: 0010:allocanddissolvehugetlbfolio+0x1d/0x1f0 RSP: 0018:ffffc9000b30fa90 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000342cca RCX: ffffea0043000000 RDX: ffffc9000b30fb08 RSI: ffffea0043000000 RDI: 0000000000000000 RBP: ffffc9000b30fb20 R08: 0000000000001000 R09: 0000000000000000 R10: ffff88886f92eb00 R11: 0000000000000000 R12: ffffea0043000000 R13: 0000000000000000 R14: 00000000010c0200 R15: 0000000000000004 FS: 00007fcda5f14740(0000) GS:ffff8888ec1d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000028 CR3: 0000000391402000 CR4: 0000000000350ef0 Call Trace: <TASK> replacefreehugepagefolios+0xb6/0x100 alloccontigrangenoprof+0x18a/0x590 ? srsoreturnthunk+0x5/0x5f ? downread+0x12/0xa0 ? srsoreturnthunk+0x5/0x5f cmarangealloc.constprop.0+0x131/0x290 cmaalloc+0xcf/0x2c0 cmaallocwrite+0x43/0xb0 simpleattrwritexsigned.constprop.0.isra.0+0xb2/0x110 debugfsattrwrite+0x46/0x70 fullproxywrite+0x62/0xa0 vfswrite+0xf8/0x420 ? srsoreturnthunk+0x5/0x5f ? filpflush+0x86/0xa0 ? srsoreturnthunk+0x5/0x5f ? filpclose+0x1f/0x30 ? srsoreturnthunk+0x5/0x5f ? dodup2+0xaf/0x160 ? srsoreturnthunk+0x5/0x5f ksyswrite+0x65/0xe0 dosyscall64+0x64/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
There is a potential race between updateandfreehugetlbfolio() and replacefreehugepagefolios():
CPU1 CPU2 updateandfreehugetlbfolio replacefreehugepagefolios foliotesthugetlb(folio) -- It's still hugetlb folio.
folioclearhugetlb(folio) hugetlbfreefolio(folio) h = foliohstate(folio) -- Here, h is NULL pointer
When the above race condition occurs, foliohstate(folio) returns NULL, and subsequent access to this NULL pointer will cause the system to crash. To resolve this issue, execute foliohstate(folio) under the protection of the hugetlblock lock, ensuring that foliohstate(folio) does not return NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In replace_free_hugepage_folios(), execute folio_hstate(folio) under protection of the hugetlb_lock lock so it cannot return NULL during the race with __update_and_free_hugetlb_folio().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38050?
The severity of CVE-2025-38050 is medium with a CVSS score of 5.5.
What is CVE-2025-38050 about?
CVE-2025-38050 addresses a kernel NULL pointer dereference vulnerability in the Linux kernel that can lead to a kernel crash.
How do I fix CVE-2025-38050?
To fix CVE-2025-38050, a patch is available that needs to be applied to the Linux kernel.
What impact does CVE-2025-38050 have?
CVE-2025-38050 can lead to a kernel crash when replacing free hugetlb folios, affecting system stability.
Is CVE-2025-38050 a common vulnerability?
CVE-2025-38050 is categorized under Null Pointer Dereference and Race Condition vulnerabilities, making it significant within kernel security.