CVE: CVE-2025-39776
Published: 2025-09-11
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/debug_vm_pgtable: clear page table entries at destroy_args()

The mm/debug_vm_pagetable test allocates manually page table entries for
the tests it runs, using also its manually allocated mm_struct.  That in
itself is ok, but when it exits, at destroy_args() it fails to clear those
entries with the *_clear functions.

The problem is that leaves stale entries.  If another process allocates an
mm_struct with a pgd at the same address, it may end up running into the
stale entry.  This is happening in practice on a debug kernel with
CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra
debugging I added (it prints a warning trace if pgtables_bytes goes
negative, in addition to the warning at check_mm() function):

[    2.539353] debug_vm_pgtable: [get_random_vaddr         ]: random_vaddr is 0x7ea247140000
[    2.539366] kmem_cache info
[    2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x[PII_REDACTED]000000 - offset 0x508
[    2.539447] debug_vm_pgtable: [init_args                ]: args->mm is 0x[PII_REDACTED]67cc9e
(...)
[    2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0
[    2.552816] Modules linked in:
[    2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY
[    2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries
[    2.552872] NIP:  c[PII_REDACTED]eef3c LR: c[PII_REDACTED]eef30 CTR: c[PII_REDACTED]d8c90
[    2.552885] REGS: c[PII_REDACTED]e73b0 TRAP: 0700   Not tainted  (6.12.0-105.debug_vm2.el10.ppc64le+debug)
[    2.552899] MSR: [PII_REDACTED]82b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 24002822  XER: 0000000a
[    2.552954] CFAR: c[PII_REDACTED]f03f0 IRQMASK: 0
[    2.552954] GPR00: c[PII_REDACTED]eef30 c[PII_REDACTED]e7650 c000000002b1ac00 [PII_REDACTED]
[    2.552954] GPR04: [PII_REDACTED] [PII_REDACTED] c[PII_REDACTED]eef30 ffffffffffffffff
[    2.552954] GPR08: 00000000ffff00f5 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[    2.552954] GPR12: 00000003fa440000 c000000017ffa300 c[PII_REDACTED]d9f80 ffffffffffffffdb
[    2.552954] GPR16: [PII_REDACTED] [PII_REDACTED][PII_REDACTED]00000a[PII_REDACTED]0000e0
[    2.552954] GPR20: [PII_REDACTED] c[PII_REDACTED]af038 00007fffcf130000 [PII_REDACTED]
[    2.552954] GPR24: c000000062a6a000 [PII_REDACTED][PII_REDACTED]a68000 [PII_REDACTED]
[    2.552954] GPR28:[PII_REDACTED]00000a c000000062ebc600 [PII_REDACTED] c000000062ebc760
[    2.553170] NIP [c[PII_REDACTED]eef3c] free_pud_range+0x8bc/0x8d0
[    2.553185] LR [c[PII_REDACTED]eef30] free_pud_range+0x8b0/0x8d0
[    2.553199] Call Trace:
[    2.553207] [c[PII_REDACTED]e7650] [c[PII_REDACTED]eef30] free_pud_range+0x8b0/0x8d0 (unreliable)
[    2.553229] [c[PII_REDACTED]e7750] [c[PII_REDACTED]f40b4] free_pgd_range+0x284/0x3b0
[    2.553248] [c[PII_REDACTED]e7800] [c[PII_REDACTED]f4630] free_pgtables+0x450/0x570
[    2.553274] [c[PII_REDACTED]e78e0] [c[PII_REDACTED]161c0] exit_mmap+0x250/0x650
[    2.553292] [c[PII_REDACTED]e7a30] [c[PII_REDACTED]b95b8] __mmput+0x98/0x290
[    2.558344] [c[PII_REDACTED]e7a80] [c[PII_REDACTED]d1018] exit_mm+0x118/0x1b0
[    2.558361] [c[PII_REDACTED]e7ac0] [c[PII_REDACTED]d141c] do_exit+0x2ec/0x870
[    2.558376] [c[PII_REDACTED]e7b60] [c[PII_REDACTED]d1ca8] do_group_exit+0x88/0x150
[    2.558391] [c[PII_REDACTED]e7bb0] [c[PII_REDACTED]d1db8] sys_exit_group+0x48/0x50
[    2.558407] [c[PII_REDACTED]e7be0] [c[PII_REDACTED]3d810] system_call_exception+0x1e0/0x4c0
[    2.558423] [c[PII_REDACTED]e7e50] [c[PII_REDACTED]0d05c] system_call_vectored_common+0x15c/0x2ec
(...)
[    2.558892] ---[ end trace [PII_REDACTED] ]---
[    2.559022] BUG: Bad rss-counter state mm:[PII_REDACTED]67cc9e type:MM_ANONPAGES val:1
[    2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144

Here the modprobe process ended up with an allocated mm_struct from the
mm_struct slab that was used before by the debug_vm_pgtable test.  That is
not a problem, since the mm_stru
---truncated---
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/47d2a149611b8a94d24add9868c442a4af278658; https://git.kernel.org/stable/c/561171db3b3eb759ba3f284dba7a76f4476ade03; https://git.kernel.org/stable/c/61a9f2e5c49f05e3ea2c16674540a075a1b4be6f