CVE-2025-38008 (GCVE-0-2025-38008)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:28 – Updated: 2026-05-11 21:19
VLAI
Title
mm/page_alloc: fix race condition in unaccepted memory handling
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix race condition in unaccepted memory handling The page allocator tracks the number of zones that have unaccepted memory using static_branch_enc/dec() and uses that static branch in hot paths to determine if it needs to deal with unaccepted memory. Borislav and Thomas pointed out that the tracking is racy: operations on static_branch are not serialized against adding/removing unaccepted pages to/from the zone. Sanity checks inside static_branch machinery detects it: WARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0 The comment around the WARN() explains the problem: /* * Warn about the '-1' case though; since that means a * decrement is concurrent with a first (0->1) increment. IOW * people are trying to disable something that wasn't yet fully * enabled. This suggests an ordering problem on the user side. */ The effect of this static_branch optimization is only visible on microbenchmark. Instead of adding more complexity around it, remove it altogether.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6 , < 98fdd2f612e949c652693f6df00442c81037776d (git)
Affected: dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6 , < 74953f93f47a45296cc2a3fd04e2a3202ff3fa53 (git)
Affected: dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6 , < 71dda1cb10702dc2859f00eb789b0502de2176a9 (git)
Affected: dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6 , < fefc075182275057ce607effaa3daa9e6e3bdc73 (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.92 , ≤ 6.6.* (semver)
Unaffected: 6.12.30 , ≤ 6.12.* (semver)
Unaffected: 6.14.8 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/internal.h",
            "mm/mm_init.c",
            "mm/page_alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98fdd2f612e949c652693f6df00442c81037776d",
              "status": "affected",
              "version": "dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6",
              "versionType": "git"
            },
            {
              "lessThan": "74953f93f47a45296cc2a3fd04e2a3202ff3fa53",
              "status": "affected",
              "version": "dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6",
              "versionType": "git"
            },
            {
              "lessThan": "71dda1cb10702dc2859f00eb789b0502de2176a9",
              "status": "affected",
              "version": "dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6",
              "versionType": "git"
            },
            {
              "lessThan": "fefc075182275057ce607effaa3daa9e6e3bdc73",
              "status": "affected",
              "version": "dcdfdd40fa82b6704d2841938e5c8ec3051eb0d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/internal.h",
            "mm/mm_init.c",
            "mm/page_alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.92",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.30",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: fix race condition in unaccepted memory handling\n\nThe page allocator tracks the number of zones that have unaccepted memory\nusing static_branch_enc/dec() and uses that static branch in hot paths to\ndetermine if it needs to deal with unaccepted memory.\n\nBorislav and Thomas pointed out that the tracking is racy: operations on\nstatic_branch are not serialized against adding/removing unaccepted pages\nto/from the zone.\n\nSanity checks inside static_branch machinery detects it:\n\nWARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0\n\nThe comment around the WARN() explains the problem:\n\n\t/*\n\t * Warn about the \u0027-1\u0027 case though; since that means a\n\t * decrement is concurrent with a first (0-\u003e1) increment. IOW\n\t * people are trying to disable something that wasn\u0027t yet fully\n\t * enabled. This suggests an ordering problem on the user side.\n\t */\n\nThe effect of this static_branch optimization is only visible on\nmicrobenchmark.\n\nInstead of adding more complexity around it, remove it altogether."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:19:31.804Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98fdd2f612e949c652693f6df00442c81037776d"
        },
        {
          "url": "https://git.kernel.org/stable/c/74953f93f47a45296cc2a3fd04e2a3202ff3fa53"
        },
        {
          "url": "https://git.kernel.org/stable/c/71dda1cb10702dc2859f00eb789b0502de2176a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fefc075182275057ce607effaa3daa9e6e3bdc73"
        }
      ],
      "title": "mm/page_alloc: fix race condition in unaccepted memory handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38008",
    "datePublished": "2025-06-18T09:28:19.358Z",
    "dateReserved": "2025-04-16T04:51:23.977Z",
    "dateUpdated": "2026-05-11T21:19:31.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38008",
      "date": "2026-05-30",
      "epss": "0.0005",
      "percentile": "0.1597"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38008\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T10:15:32.037\",\"lastModified\":\"2025-11-17T12:56:52.697\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/page_alloc: fix race condition in unaccepted memory handling\\n\\nThe page allocator tracks the number of zones that have unaccepted memory\\nusing static_branch_enc/dec() and uses that static branch in hot paths to\\ndetermine if it needs to deal with unaccepted memory.\\n\\nBorislav and Thomas pointed out that the tracking is racy: operations on\\nstatic_branch are not serialized against adding/removing unaccepted pages\\nto/from the zone.\\n\\nSanity checks inside static_branch machinery detects it:\\n\\nWARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0\\n\\nThe comment around the WARN() explains the problem:\\n\\n\\t/*\\n\\t * Warn about the \u0027-1\u0027 case though; since that means a\\n\\t * decrement is concurrent with a first (0-\u003e1) increment. IOW\\n\\t * people are trying to disable something that wasn\u0027t yet fully\\n\\t * enabled. This suggests an ordering problem on the user side.\\n\\t */\\n\\nThe effect of this static_branch optimization is only visible on\\nmicrobenchmark.\\n\\nInstead of adding more complexity around it, remove it altogether.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/page_alloc: arregla la condici\u00f3n de ejecuci\u00f3n en el manejo de memoria no aceptada El asignador de p\u00e1ginas rastrea el n\u00famero de zonas que tienen memoria no aceptada usando static_branch_enc/dec() y usa esa rama est\u00e1tica en rutas activas para determinar si necesita lidiar con memoria no aceptada. Borislav y Thomas se\u00f1alaron que el rastreo es acelerado: las operaciones en static_branch no se serializan contra la adici\u00f3n/eliminaci\u00f3n de p\u00e1ginas no aceptadas a/desde la zona. Las comprobaciones de cordura dentro de la maquinaria static_branch lo detectan: ADVERTENCIA: CPU: 0 PID: 10 en kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0 El comentario alrededor de WARN() explica el problema: /* * Sin embargo, advierte sobre el caso \u0027-1\u0027; ya que eso significa que un * decremento es concurrente con un primer incremento (0-\u0026gt;1). Es decir, * se est\u00e1 intentando deshabilitar algo que a\u00fan no estaba completamente habilitado. Esto sugiere un problema de ordenamiento del usuario. */ El efecto de esta optimizaci\u00f3n de static_branch solo es visible en microbenchmark. En lugar de a\u00f1adir m\u00e1s complejidad, elim\u00ednenla por completo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.92\",\"matchCriteriaId\":\"D0DDEC71-DA9A-4DD8-9AE4-E164CFC5E573\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.30\",\"matchCriteriaId\":\"8F43EF2E-9448-4BCA-99D9-DAEAEB7523C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.8\",\"matchCriteriaId\":\"D4458049-AD51-4F1B-BAB9-C32B53A54DE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"90320558-E553-4EF5-8A0B-0F5D20113BD2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/71dda1cb10702dc2859f00eb789b0502de2176a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/74953f93f47a45296cc2a3fd04e2a3202ff3fa53\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/98fdd2f612e949c652693f6df00442c81037776d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fefc075182275057ce607effaa3daa9e6e3bdc73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.