CVE-2025-40006

一、漏洞信息
 漏洞编号：[CVE-2025-40006](https://nvd.nist.gov/vuln/detail/CVE-2025-40006)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V4.0分值：
  BaseScore：N/A None
  Vector：
 漏洞简述：
  In the Linux kernel, a race condition vulnerability exists in the mm/hugetlb subsystem. Migration may race with fallocating hole operations. The remove_inode_single_folio function checks if the folio is still mapped without holding the folio lock. If the folio is migrated and the mapped page table entry has been converted to a migration entry, folio_mapped() returns false and fails to unmap it. Due to the extra refcount held by remove_inode_single_folio, migration fails, restores the migration entry to a normal page table entry, and the folio is mapped again, ultimately triggering a BUG in filemap_unaccount_folio.
 漏洞公开时间：2025-10-21 00:15:37
 漏洞创建时间：2025-10-20 23:53:40
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-40006
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39832 |  |
|  | https://git.kernel.org/stable/c/91f548e920fbf8be3f285bfa3fa045ae017e836d |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.115 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39880 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.111 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39973 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39977 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.109 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-40006 |  |
|  | https://bugs.mageia.org/show_bug.cgi?id=34721 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2634 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40071 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39847 |  |
|  | https://advisories.mageia.org/MGASA-2025-0309.html |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40021 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39742 |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-40006 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2635 |  |
|  | https://linux.oracle.com/errata/ELSA-2025-28049.html |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39972 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22093 |  |
|  | https://advisory.echohq.com/cve/CVE-2025-40006 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.108 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39889 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39685 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.110 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025102002-CVE-2025-40006-eb23@gregkh/T/#u |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.114 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.106 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39970 |  |
|  | https://git.kernel.org/stable/c/21ee79ce938127f88fe07e409c1817f477dbe7ea |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39725 |  |
|  | https://git.kernel.org/stable/c/910d7749346c4b0acdc6e4adfdc4a9984281a206 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40042 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.116 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39860 |  |
|  | https://linux.oracle.com/errata/ELSA-2025-28048.html |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.112 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21991 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2633 |  |
|  | https://git.kernel.org/stable/c/c9c2a51f91aea70e89b496cac360cd795a2b3c26 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39701 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40081 |  |
|  | https://advisories.mageia.org/MGASA-2025-0310.html |  |
|  | https://git.kernel.org/stable/c/7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39945 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39949 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2405113 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.113 |  |
|  | https://bugs.mageia.org/show_bug.cgi?id=34713 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40057 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39782 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39969 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40102 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40006 |  |
|  | https://git.kernel.org/stable/c/c1dc0524ab2cc3982d4e0d2bfac71a0cd4d65c39 |  |
|  | https://git.kernel.org/stable/c/bc1c9ce8aeff45318332035dbef9713fb9e982d7 |  |
|  | https://linux.oracle.com/cve/CVE-2025-40006.html |  |
|  | https://git.kernel.org/stable/c/3e851448078f5b01f6264915df3cfef75e323a12 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37998 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.107 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/c1dc0524ab2cc3982d4e0d2bfac71a0cd4d65c39 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/c9c2a51f91aea70e89b496cac360cd795a2b3c26 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/910d7749346c4b0acdc6e4adfdc4a9984281a206 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/21ee79ce938127f88fe07e409c1817f477dbe7ea |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/3e851448078f5b01f6264915df3cfef75e323a12 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/bc1c9ce8aeff45318332035dbef9713fb9e982d7 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/91f548e920fbf8be3f285bfa3fa045ae017e836d |  | ljqc |
|  |  | https://git.kernel.org/stable/c/91f548e920fbf8be3f285bfa3fa045ae017e836d |  | cvedetails |
|  |  | https://git.kernel.org/stable/c/21ee79ce938127f88fe07e409c1817f477dbe7ea |  | cvedetails |
|  |  | https://git.kernel.org/stable/c/910d7749346c4b0acdc6e4adfdc4a9984281a206 |  | cvedetails |
|  |  | https://git.kernel.org/stable/c/c9c2a51f91aea70e89b496cac360cd795a2b3c26 |  | cvedetails |
|  |  | https://git.kernel.org/stable/c/7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 |  | cvedetails |
|  |  | https://git.kernel.org/stable/c/c1dc0524ab2cc3982d4e0d2bfac71a0cd4d65c39 |  | cvedetails |
|  |  | https://git.kernel.org/stable/c/bc1c9ce8aeff45318332035dbef9713fb9e982d7 |  | cvedetails |
|  |  | https://git.kernel.org/stable/c/3e851448078f5b01f6264915df3cfef75e323a12 |  | cvedetails |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
            In the Linux kernel, the following vulnerability has been resolved:mm/hugetlb: fix folio is still mapped when deletedMigration may be raced with fallocating hole.  remove_inode_single_foliowill unmap the folio if the folio is still mapped.  However, it&#39;s calledwithout folio lock.  If the folio is migrated and the mapped pte has beenconverted to migration entry, folio_mapped() returns false, and won&#39;tunmap it.  Due to extra refcount held by remove_inode_single_folio,migration fails, restores migration entry to normal pte, and the folio ismapped again.  As a result, we triggered BUG in filemap_unaccount_folio.The log is as follows: BUG: Bad page cache in process hugetlb  pfn:156c00 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0 aops:hugetlbfs_aops ino:dcc dentry name(?):&#34;my_hugepage_file&#34; flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f4(hugetlb) page dumped because: still mapped when deleted CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Call Trace:  &lt;TASK&gt;  dump_stack_lvl+0x4f/0x70  filemap_unaccount_folio+0xc4/0x1c0  __filemap_remove_folio+0x38/0x1c0  filemap_remove_folio+0x41/0xd0  remove_inode_hugepages+0x142/0x250  hugetlbfs_fallocate+0x471/0x5a0  vfs_fallocate+0x149/0x380Hold folio lock before checking if the folio is mapped to avold race withmigration.The Linux kernel CVE team has assigned CVE-2025-40006 to this issue.     
 openEuler评分：
  4.7
 Vector：CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP2(6.6.0):受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel
Closed

Content Risk Flag

Comments (7)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-40006

Comments (7)

Search

src-openEuler/kernel
Closed