UBUNTU-CVE-2025-39725: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Who is realistically exposed to this issue?

Exposure is limited to systems using one of the listed Ubuntu Linux kernel packages where memory reclaim can race with hardware memory-failure handling for a large folio. The description notes that uncorrectable errors are rare in practice, and the required race with reclamation is rarer still.

Q: What level of access would an attacker need?

The supplied CVSS vector indicates local attack access and low privileges are required. No user interaction is required, but exploitation also depends on the specific large-folio hardware-poisoning and memory-reclaim race occurring.

Q: What is the expected impact if the race occurs?

The race can cause a null-pointer dereference or BUG condition during poisoned-folio handling, leading to a kernel panic. The stated impact is availability loss; no confidentiality or integrity impact is indicated by the supplied CVSS vector.

Published Sep 5, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix hwpoisoned large folio handling in shrinkfoliolist In shrinkfoliolist(), the hwpoisoned folio may be large folio, which can't be handled by unmappoisonedfolio(). For THP, trytounmapone() must be passed with TTUSPLITHUGEPMD to split huge PMD first and then retry. Without TTUSPLITHUGEPMD, we will trigger null-ptr deref of pvmw.pte. Even we passed TTUSPLITHUGEPMD, we will trigger a WARNONONCE due to the page isn't in swapcache. Since UCE is rare in real world, and race with reclaimation is more rare, just skipping the hwpoisoned large folio is enough. memoryfailure() will handle it if the UCE is triggered again. This happens when memory reclaim for large folio races with memoryfailure(), and will lead to kernel panic. The race is as follows: cpu0 cpu1 shrinkfoliolist memoryfailure TestSetPageHWPoison unmappoisonedfolio --> trigger BUGON due to unmappoisonedfolio couldn't handle large folio [tujinjiang@huawei.com: add comment to unmappoisonedfolio()]

Affected Software

97 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1020.21~24.04.1

6.14.0-1020.21~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-intel*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-oem-6.14<6.14.0-1016.16

6.14.0-1016.16

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-36.36.1~24.04.1

6.14.0-36.36.1~24.04.1

ubuntu/linux-realtime-6.14<6.14.0-1016.16~24.04.1

6.14.0-1016.16~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1020.21~24.04.1
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-36.36.1~24.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16~24.04.1
Compensating control
In shrink_folio_list(), skip hwpoisoned large folios instead of passing them to unmap_poisoned_folio().
Compensating control
For transparent huge pages, pass TTU_SPLIT_HUGE_PMD to try_to_unmap_one() to split the huge PMD before retrying.

Event History

Sep 5, 2025

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Exposure is limited to systems using one of the listed Ubuntu Linux kernel packages where memory reclaim can race with hardware memory-failure handling for a large folio. The description notes that uncorrectable errors are rare in practice, and the required race with reclamation is rarer still.

What level of access would an attacker need?

The supplied CVSS vector indicates local attack access and low privileges are required. No user interaction is required, but exploitation also depends on the specific large-folio hardware-poisoning and memory-reclaim race occurring.

What is the expected impact if the race occurs?

The race can cause a null-pointer dereference or BUG condition during poisoned-folio handling, leading to a kernel panic. The stated impact is availability loss; no confidentiality or integrity impact is indicated by the supplied CVSS vector.

UBUNTU-CVE-2025-39725: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access would an attacker need?

What is the expected impact if the race occurs?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access would an attacker need?

What is the expected impact if the race occurs?