In the Linux kernel, the following vulnerability has been resolved:
hugetlbfs: don't delete error page from pagecache
This change is very similar to the change that was made for shmem [1], and it solves the same problem but for HugeTLBFS instead.
Currently, when poison is found in a HugeTLB page, the page is removed from the page cache. That means that attempting to map or read that hugepage in the future will result in a new hugepage being allocated instead of notifying the user that the page was poisoned. As [1] states, this is effectively memory corruption.
The fix is to leave the page in the page cache. If the user attempts to use a poisoned HugeTLB page with a syscall, the syscall will fail with EIO, the same error code that shmem uses. For attempts to map the page, the thread will get a BUS_MCEERR_AR SIGBUS.
[1]: commit a76054266661 ("mm: shmem: don't truncate page if memory failure happens")
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.86-53.137Upgrade perfUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfo | Jun 23, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 5, 2025 | May 1, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade python3-perf | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Ubuntu | — | Upgrade linux-riscv-5.15Upgrade linux-ibmUpgrade linux-oracleUpgrade linux-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-azure-fde-5.15Upgrade linux-gkeUpgrade linux-gkeopUpgrade linux-azure-5.15Upgrade linux-kvmUpgrade linux-oracle-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azureUpgrade linux-nvidiaUpgrade linux-gcp-5.15Upgrade linux-intel-iotgUpgrade linux-bluefieldUpgrade linux-aws-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-realtimeUpgrade linux-nvidia-tegra-5.15Upgrade linux-azure-fdeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcpUpgrade linux-raspiUpgrade linuxUpgrade linux-aws | May 8, 2025 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub