{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-37958", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-37958", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2025-05-20T16:01:51.740Z", "updatedAt": "2026-05-11T21:18:23.635Z", "importedAt": "2026-10-24T01:57:34.152Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "mm/huge_memory: fix dereferencing invalid pmd migration entry", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix dereferencing invalid pmd migration entry\n\nWhen migrating a THP, concurrent access to the PMD migration entry during\na deferred split scan can lead to an invalid address access, as\nillustrated below. To prevent this invalid access, it is necessary to\ncheck the PMD migration entry and return early. In this context, there is\nno need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the\nequality of the target folio. Since the PMD migration entry is locked, it\ncannot be served as the target.\n\nMailing list discussion and explanation from Hugh Dickins: \"An anon_vma\nlookup points to a location which may contain the folio of interest, but\nmight instead contain another folio: and weeding out those other folios is\nprecisely what the \"folio != pmd_folio((*pmd)\" check (and the \"risk of\nreplacing the wrong folio\" comment a few lines above it) is for.\"\n\nBUG: unable to handle page fault for address: ffffea60001db008\nCPU: 0 UID: 0 PID: 2199114 Comm: tee Not tainted 6.14.0+ #4 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:split_huge_pmd_locked+0x3b5/0x2b60\nCall Trace:\n\ntry_to_migrate_one+0x28c/0x3730\nrmap_walk_anon+0x4f6/0x770\nunmap_folio+0x196/0x1f0\nsplit_huge_page_to_list_to_order+0x9f6/0x1560\ndeferred_split_scan+0xac5/0x12a0\nshrinker_debugfs_scan_write+0x376/0x470\nfull_proxy_write+0x15c/0x220\nvfs_write+0x2fc/0xcb0\nksys_write+0x146/0x250\ndo_syscall_64+0x6a/0x120\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe bug is found by syzkaller on an internal kernel, then confirmed on\nupstream.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "753f142f7ff7d2223a47105b61e1efd91587d711" }, { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "9468afbda3fbfcec21ac8132364dff3dab945faf" }, { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "ef5706bed97e240b4abf4233ceb03da7336bc775" }, { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "22f6368768340260e862f35151d2e1c55cb1dc75" }, { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "3977946f61cdba87b6b5aaf7d7094e96089583a5" }, { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "6166c3cf405441f7147b322980144feb3cefc617" }, { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "fbab262b0c8226c697af1851a424896ed47dedcc" }, { "version": "84c3fc4e9c563d8fb91cfdf5948da48fe1af34d3", "status": "affected", "versionType": "git", "lessThan": "be6e843fc51a584672dfd9c4a6a24c8cb81d5fb7" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.14", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.14" }, { "version": "5.4.295", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.239", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.186", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.142", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.95", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.29", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.14.7", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.14.*" }, { "version": "6.15", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }