CVE-2025-37818

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Return NULL from huge_pte_offset() for invalid PMD

LoongArch's huge_pte_offset() currently returns a pointer to a PMD slot

even if the underlying entry points to invalid_pte_table (indicating no

mapping). Callers like smaps_hugetlb_range() fetch this invalid entry

value (the address of invalid_pte_table) via this pointer.

The generic is_swap_pte() check then incorrectly identifies this address

as a swap entry on LoongArch, because it satisfies the "!pte_present()

&& !pte_none()" conditions. This misinterpretation, combined with a

coincidental match by is_migration_entry() on the address bits, leads to

kernel crashes in pfn_swap_entry_to_page().

Fix this at the architecture level by modifying huge_pte_offset() to

check the PMD entry's content using pmd_none() before returning. If the

entry is invalid (i.e., it points to invalid_pte_table), return NULL

instead of the pointer to the slot.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References