CVE-2025-39776
Description
In the Linux kernel, the following vulnerability has been resolved:
mm/debug_vm_pgtable: clear page table entries at destroy_args()
The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions.
The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function):
[ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144
Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated---
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In the Linux kernel, the mm/debug_vm_pgtable test fails to clear page table entries during cleanup, leaving stale entries that can cause memory corruption and potential use-after-free for other processes.
Vulnerability
Description
The Linux kernel's mm/debug_vm_pgtable test module allocates page table entries for its own tests using a manually allocated mm_struct. When the module exits via destroy_args(), it fails to clear those entries with the appropriate *_clear functions, leaving stale page table entries in memory [1]. This oversight can lead to memory corruption warnings and system instability, as demonstrated by a kernel warning trace showing a negative pgtables_bytes counter and a call to free_pud_range [1].
Exploitation
Scenario
The vulnerability is triggered when the debug_vm_pgtable test module is loaded and then unloaded. The stale entries remain in the page table structures. If another process subsequently allocates an mm_struct whose page global directory (pgd) happens to occupy the same memory address, that process may encounter the stale entries, leading to incorrect page table walks and potential memory corruption [1]. No special privileges are required to load the test module, but the module is typically only enabled in debug kernels with CONFIG_DEBUG_VM_PGTABLE=y.
Impact
An attacker who can trigger the loading and unloading of the debug_vm_pgtable module (or who relies on a system administrator doing so) could cause memory corruption, leading to system crashes or unpredictable behavior. In the worst case, memory corruption might be leveraged for privilege escalation, though the CVE description does not explicitly confirm this [1].
Mitigation
The fix is included in Linux kernel stable updates. Patches have been committed to the kernel stable tree [2][3][4]. Users should update their kernel to a version containing the fix. The vulnerability also affects Siemens SIMATIC CN 4100 devices running affected kernel versions; Siemens has released an advisory listing this CVE among others [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
6- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- Linux/Linuxv5Range: 5.15
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- git.kernel.org/stable/c/47d2a149611b8a94d24add9868c442a4af278658nvdPatch
- git.kernel.org/stable/c/561171db3b3eb759ba3f284dba7a76f4476ade03nvdPatch
- git.kernel.org/stable/c/61a9f2e5c49f05e3ea2c16674540a075a1b4be6fnvdPatch
- git.kernel.org/stable/c/63962ff932ef359925b94be2a88df6b4fd4fed0anvdPatch
- git.kernel.org/stable/c/7bf57a0709cd7c9088cea8de023d6f4fbf2518b0nvdPatch
- git.kernel.org/stable/c/dde30854bddfb5d69f30022b53c5955a41088b33nvdPatch
- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlnvdThird Party Advisory
- cert-portal.siemens.com/productcert/html/ssa-032379.htmlnvd
News mentions
1- Siemens SIMATICCISA ICS Advisories