CVE-2025-40272

Vulnerability

A race condition exists in the Linux kernel's mm/secretmem fault handler. When a page fault occurs in a secret memory file created with memfd_secret(2), the kernel allocates a new folio, removes the underlying page from the direct map, and adds the folio to the file mapping. If two tasks trigger a fault on the same page concurrently, both may allocate a folio and attempt the removal, but only one succeeds in adding the folio. The failing task frees its folio before restoring the direct map, creating a window where the freed page is available to the allocator but still absent from the direct map.

Exploitation

An attacker with local access and the ability to trigger concurrent page faults on the same secret memory page can exploit this race. No special privileges beyond being able to create and access secret memory files via memfd_secret(2) are required. The vulnerability is triggered during normal memory management operations, making it potentially reachable through unprivileged userspace code.

Impact

During the window between freeing the folio and restoring the direct map, any kernel access to the page via the direct map will cause a supervisor not-present page fault, leading to a denial of service (system crash). The issue is a use-after-free that can result in memory corruption and system instability.

Mitigation

The fix reorders the operations so that the direct map is restored before the folio is freed [1][2][3]. Patched versions are available via stable kernel updates. Systems unable to apply the patch should mitigate by restricting access to secret memory functionality or using kernel protections like KASLR and SMAP to reduce exploitability.