CVE-2025-40245

Analysis

In the Linux kernel for the nios2 architecture, when CONFIG_FLATMEM is enabled, the kernel uses memblock_get_current_limit() to determine the bounds of the memory map, specifically for max_low_pfn. During early boot, memblock.current_limit is only default-initialized to MEMBLOCK_ALLOC_ANYWHERE, which may not reflect the actual physical memory limits [1]. This can lead to max_low_pfn being set to a value that exceeds max_pfn, thereby referring to memory beyond the available DRAM.

An attacker does not need special privileges to trigger this state; it can occur if the system has certain memory configurations that expose the initialization gap. When the kernel later accesses memory pages that it believes are valid but actually lie outside the physical RAM, a paging request fails, as exemplified by the kernel panic trace showing an "Unable to handle kernel paging request" at address 20303000. This results in a system crash (kernel oops and panic) [2].

The impact is a denial of service (system crash) on affected nios2 systems. No workaround is provided beyond applying the patch. The fix introduces a call to adjust_lowmem_bounds early in boot, which pre-calculates memblock.current_limit based on the upper limits of available memory ranges, following a similar approach used in the ARM architecture. This patch has been merged into the stable kernel trees; users should update their kernels to the corrected version.