CVE-2025-39992

Vulnerability

Overview

CVE-2025-39992 is a race condition in the Linux kernel's memory management subsystem, specifically in the swapoff path. The bug occurs when unuse_mm() traverses the virtual memory area (VMA) tree of a process that is concurrently undergoing fork(). During fork, if a fatal signal is sent to the parent process, the VMA tree may contain XA_ZERO_ENTRY markers instead of valid VMA pointers. When swapoff later iterates over this tree via unuse_mm(), it attempts to dereference the zero entry as a VMA, leading to a kernel NULL pointer dereference and an OOPS [1].

Exploitation

Conditions

The vulnerability is triggered by a specific race between fork() (specifically dup_mmap()) and swapoff. The fork process builds an identical maple tree (mtree) using __mt_dup(), then copies page tables. During copy_nonpresent_pte(), the destination mm is added to the mmlist, making it visible to swapoff. If a fatal signal is sent to the parent before VMA duplication completes, the VMA range is marked with XA_ZERO_ENTRY as a placeholder for exit_mmap(). Swapoff, running concurrently, then iterates over this partially-valid tree and hits the zero entry, causing the crash [1].

Impact

An attacker who can trigger swapoff (e.g., by exhausting swap space or through privileged operations) and induce the race condition can cause a kernel NULL pointer dereference, resulting in a system crash (denial of service). The vulnerability does not require special privileges beyond those needed to trigger swapoff, but the race window is narrow. No code execution or privilege escalation is indicated [1].

Mitigation

The proper fix involves not exposing the partially-valid tree to other operations when the mmap lock is dropped, as addressed in a separate commit [1]. A simpler workaround is to check for the MMF_UNSTABLE flag, which is set when the mm_struct is not fully initialized during dup_mmap(). The kernel community has acknowledged the issue and recommends applying the stable kernel patch referenced in the advisory [1].