CVE ID : CVE-2025-40009<\/p>\n
Published : Oct. 20, 2025, 4:15 p.m. | 26\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/proc\/task_mmu: check p->vec_buf for NULL<\/p>\n
When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches
\npagemap_scan_backout_range(), kernel panics with null-ptr-deref:<\/p>\n[ 44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
\n[ 44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n[ 44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none)
\n[ 44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04\/01\/2014
\n[ 44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741\/0xa80<\/p>\n[ 44.946828] Call Trace:
\n[ 44.947030]\n[ 44.949219] pagemap_scan_pmd_entry+0xec\/0xfa0
\n[ 44.952593] walk_pmd_range.isra.0+0x302\/0x910
\n[ 44.954069] walk_pud_range.isra.0+0x419\/0x790
\n[ 44.954427] walk_p4d_range+0x41e\/0x620
\n[ 44.954743] walk_pgd_range+0x31e\/0x630
\n[ 44.955057] __walk_page_range+0x160\/0x670
\n[ 44.956883] walk_page_range_mm+0x408\/0x980
\n[ 44.958677] walk_page_range+0x66\/0x90
\n[ 44.958984] do_pagemap_scan+0x28d\/0x9c0
\n[ 44.961833] do_pagemap_cmd+0x59\/0x80
\n[ 44.962484] __x64_sys_ioctl+0x18d\/0x210
\n[ 44.962804] do_syscall_64+0x5b\/0x290
\n[ 44.963111] entry_SYSCALL_64_after_hwframe+0x76\/0x7e<\/p>\n
vec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are
\nallocated and p->vec_buf remains set to NULL.<\/p>\n
This breaks an assumption made later in pagemap_scan_backout_range(), that
\npage_region is always allocated for p->vec_buf_index.<\/p>\n
Fix it by explicitly checking p->vec_buf for NULL before dereferencing.<\/p>\n
Other sites that might run into same deref-issue are already (directly or
\ntransitively) protected by checking p->vec_buf.<\/p>\n
Note:
\nFrom PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output
\nis requested and it’s only the side effects caller is interested in,
\nhence it passes check in pagemap_scan_get_args().<\/p>\n
This issue was found by syzkaller.<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-40009 Published : Oct. 20, 2025, 4:15 p.m. | 26\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: fs\/proc\/task_mmu: check p->vec_buf for NULL When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches pagemap_scan_backout_range(), kernel panics with null-ptr-deref: [ 44.936808] Oops: general protection fault, probably for …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-72002","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72002","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=72002"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72002\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=72002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=72002"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=72002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}