CVE-2025-39992

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: swap: check for stable address space before operating on the VMA

It is possible to hit a zero entry while traversing the vmas in unuse_mm()

called from swapoff path and accessing it causes the OOPS:

Unable to handle kernel NULL pointer dereference at virtual address

0000000000000446--> Loading the memory from offset 0x40 on the

XA_ZERO_ENTRY as address.

Mem abort info:

ESR = 0x0000000096000005

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x05: level 1 translation fault

The issue is manifested from the below race between the fork() on a

process and swapoff:

fork(dup_mmap()) swapoff(unuse_mm)

--------------- -----------------

1) Identical mtree is built using

__mt_dup().

2) copy_pte_range()-->

copy_nonpresent_pte():

The dst mm is added into the

mmlist to be visible to the

swapoff operation.

3) Fatal signal is sent to t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References