CVE-2025-39725: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
In the Linux kernel, the following vulnerability has been resolved:
mm/vmscan: fix hwpoisoned large folio handling in shrinkfoliolist
In shrinkfoliolist(), the hwpoisoned folio may be large folio, which can't be handled by unmappoisonedfolio(). For THP, trytounmapone() must be passed with TTUSPLITHUGEPMD to split huge PMD first and then retry. Without TTUSPLITHUGEPMD, we will trigger null-ptr deref of pvmw.pte. Even we passed TTUSPLITHUGEPMD, we will trigger a WARNONONCE due to the page isn't in swapcache.
Since UCE is rare in real world, and race with reclaimation is more rare, just skipping the hwpoisoned large folio is enough. memoryfailure() will handle it if the UCE is triggered again.
This happens when memory reclaim for large folio races with memoryfailure(), and will lead to kernel panic. The race is as follows:
cpu0 cpu1 shrinkfoliolist memoryfailure TestSetPageHWPoison unmappoisonedfolio --> trigger BUGON due to unmappoisonedfolio couldn't handle large folio
[tujinjiang@huawei.com: add comment to unmappoisonedfolio()]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1020.21~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-36.36.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16~24.04.1 - Compensating control
In shrink_folio_list(), skip hwpoisoned large folios because unmap_poisoned_folio() cannot handle them; memory_failure() will handle a subsequent UCE.
- Compensating control
For THP, call try_to_unmap_one() with TTU_SPLIT_HUGE_PMD so the huge PMD is split before retrying.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39725?
CVE-2025-39725 has been classified with moderate severity due to its impact on memory management in the Linux kernel.
How do I fix CVE-2025-39725?
To resolve CVE-2025-39725, update your Linux kernel to the latest version that includes the vulnerability fix.
What systems are affected by CVE-2025-39725?
CVE-2025-39725 affects all versions of the Linux kernel that are below the patched version.
What kind of vulnerability is CVE-2025-39725?
CVE-2025-39725 is a memory handling vulnerability related to hwpoisoned large folios in the Linux kernel.
Is there a workaround for CVE-2025-39725?
There are no officially recommended workarounds for CVE-2025-39725; updating the kernel is the best mitigation.