CVE-2025-40006

Vulnerability

In the Linux kernel's hugetlb subsystem, a race condition exists between folio migration and fallocate hole punching. The function remove_inode_single_folio is called without holding the folio lock to unmap the folio if it is still mapped. However, if the folio has been migrated and the mapped PTE has been converted to a migration entry, folio_mapped() returns false, so the unmap does not occur. The extra refcount held by remove_inode_single_folio causes migration to fail, restoring the migration entry to a normal PTE, leaving the folio mapped. This triggers a BUG in filemap_unaccount_folio when the folio is subsequently deleted.

Exploitation

An attacker with local access and the ability to trigger hugetlbfs fallocate operations (e.g., hole punching) while concurrent migration is occurring can exploit this race. No special privileges are required beyond the ability to manipulate hugetlbfs files, which may be available to unprivileged users depending on system configuration. The race window is narrow but can be triggered repeatedly.

Impact

Successful exploitation causes a kernel BUG, leading to a system crash (denial of service). The crash is accompanied by a "Bad page cache" error and a page dump indicating the folio is still mapped when deleted. This can be used to disrupt system availability.

Mitigation

The vulnerability is fixed in the Linux kernel by holding the folio lock before checking if the folio is mapped, preventing the race with migration [1]. Stable kernel updates incorporating this fix are available [2], [3]. Users should apply the latest kernel updates from their distribution.