CVE-2025-39776

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/debug_vm_pgtable: clear page table entries at destroy_args()

The mm/debug_vm_pagetable test allocates manually page table entries for

the tests it runs, using also its manually allocated mm_struct. That in

itself is ok, but when it exits, at destroy_args() it fails to clear those

entries with the *_clear functions.

The problem is that leaves stale entries. If another process allocates an

mm_struct with a pgd at the same address, it may end up running into the

stale entry. This is happening in practice on a debug kernel with

CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra

debugging I added (it prints a warning trace if pgtables_bytes goes

negative, in addition to the warning at check_mm() function):

[ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000

[ 2.539366] kmem_cache info

[ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x00000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References