In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios
A kernel crash was observed when replacing free hugetlb folios:
BUG: kernel NULL pointer dereference, address: 0000000000000028 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 28 UID: 0 PID: 29639 Comm: test_cma.sh Tainted 6.15.0-rc6-zp #41 PREEMPT(voluntary) RIP: 0010:alloc_and_dissolve_hugetlb_folio+0x1d/0x1f0 RSP: 0018:ffffc9000b30fa90 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000342cca RCX: ffffea0043000000 RDX: ffffc9000b30fb08 RSI: ffffea0043000000 RDI: 0000000000000000 RBP: ffffc9000b30fb20 R08: 0000000000001000 R09: 0000000000000000 R10: ffff88886f92eb00 R11: 0000000000000000 R12: ffffea0043000000 R13: 0000000000000000 R14: 00000000010c0200 R15: 0000000000000004 FS: 00007fcda5f14740(0000) GS:ffff8888ec1d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000028 CR3: 0000000391402000 CR4: 0000000000350ef0 Call Trace: <TASK> replace_free_hugepage_folios+0xb6/0x100 alloc_contig_range_noprof+0x18a/0x590 ? srso_return_thunk+0x5/0x5f ? down_read+0x12/0xa0 ? srso_return_thunk+0x5/0x5f cma_range_alloc.constprop.0+0x131/0x290 __cma_alloc+0xcf/0x2c0 cma_alloc_write+0x43/0xb0 simple_attr_write_xsigned.constprop.0.isra.0+0xb2/0x110 debugfs_attr_write+0x46/0x70 full_proxy_write+0x62/0xa0 vfs_write+0xf8/0x420 ? srso_return_thunk+0x5/0x5f ? filp_flush+0x86/0xa0 ? srso_return_thunk+0x5/0x5f ? filp_close+0x1f/0x30 ? srso_return_thunk+0x5/0x5f ? do_dup2+0xaf/0x160 ? srso_return_thunk+0x5/0x5f ksys_write+0x65/0xe0 do_syscall_64+0x64/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
There is a potential race between __update_and_free_hugetlb_folio() and replace_free_hugepage_folios():
CPU1 CPU2 __update_and_free_hugetlb_folio replace_free_hugepage_folios folio_test_hugetlb(folio) -- It's still hugetlb folio.
__folio_clear_hugetlb(folio) hugetlb_free_folio(folio) h = folio_hstate(folio) -- Here, h is NULL pointer
When the above race condition occurs, folio_hstate(folio) returns NULL, and subsequent access to this NULL pointer will cause the system to crash. To resolve this issue, execute folio_hstate(folio) under the protection of the hugetlb_lock lock, ensuring that folio_hstate(folio) does not return NULL.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 18, 2025 |
| Suse | — | Upgrade kernel-default-extraUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-source-azureUpgrade kernel-develUpgrade kernel-obs-qaUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-azure-extraUpgrade kernel-default-livepatchUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-azureUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade kernel-64kb-extraUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-devel | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-32-genericUpgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-azure-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-genericUpgrade linux-image-aws-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-virtual-6.14Upgrade linux-image-azureUpgrade linux-image-oracle-64kUpgrade linux-image-virtualUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-aws-64k-6.14Upgrade linux-image-oem-24.04bUpgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-raspiUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1012-azureUpgrade linux-image-oracleUpgrade linux-image-oem-24.04cUpgrade linux-image-generic-64k-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-aws | Jun 26, 2025 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub