CVE-2025-37958

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix dereferencing invalid pmd migration entry

When migrating a THP, concurrent access to the PMD migration entry during

a deferred split scan can lead to an invalid address access, as

illustrated below. To prevent this invalid access, it is necessary to

check the PMD migration entry and return early. In this context, there is

no need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the

equality of the target folio. Since the PMD migration entry is locked, it

cannot be served as the target.

Mailing list discussion and explanation from Hugh Dickins: "An anon_vma

lookup points to a location which may contain the folio of interest, but

might instead contain another folio: and weeding out those other folios is

precisely what the "folio != pmd_folio((*pmd)" check (and the "risk of

replacing the wrong folio" comment a few lines above it) is for."

BUG: unable to handle page fault for address:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References