CVE-2025-40040

一、漏洞信息
 漏洞编号：[CVE-2025-40040](https://nvd.nist.gov/vuln/detail/CVE-2025-40040)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V4.0分值：
  BaseScore：N/A None
  Vector：
 漏洞简述：
  In the Linux kernel, a vulnerability exists in the ksm_madvise function. When a user calls madvise(MADV_UNMEARGEABLE) on a VMA registered for UFFD in MINOR mode, the function accidentally clears all flags stored in the upper 32 bits of vma->vm_flags. This is caused by an incorrect type conversion error with the VM_MERGEABLE constant. On x86_64 architecture, the unsigned int constant 0x8000 0000 becomes 0x7fff ffff after ~ operation, and when converted to unsigned long, the upper 32 bits are filled with 0s, causing the AND operation to accidentally clear the upper 32-bit flags.
 漏洞公开时间：2025-10-28 20:15:37
 漏洞创建时间：2025-10-28 20:41:19
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-40040
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://lore.kernel.org/linux-cve-announce/2025102812-CVE-2025-40040-943a@gregkh/T |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.115 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.111 |  |
|  | https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.109 |  |
|  | https://bugs.mageia.org/show_bug.cgi?id=34721 |  |
|  | https://advisories.mageia.org/MGASA-2025-0309.html |  |
|  | https://lore.kernel.org/linux-cve-announce/2025102812-CVE-2025-40040-943a@gregkh/T/#u |  |
|  | https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40040 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2406730 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.108 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.110 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.114 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.106 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.116 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-40040 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.112 |  |
|  | https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe |  |
|  | https://advisories.mageia.org/MGASA-2025-0310.html |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-40040 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.113 |  |
|  | https://bugs.mageia.org/show_bug.cgi?id=34713 |  |
|  | https://advisory.echohq.com/cve/CVE-2025-40040 |  |
|  | https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd |  |
|  | https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 |  |
|  | https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 |  |
|  | https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.107 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 |  | ljqc |
|  |  | https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 |  | cvelistv5 |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:mm/ksm: fix flag-dropping behavior in ksm_madvisesyzkaller discovered the following crash: (kernel BUG)[   44.607039] ------------[ cut here ]------------[   44.607422] kernel BUG at mm/userfaultfd.c:2067![   44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI[   44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)[   44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014[   44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460&lt;snip other registers, drop unreliable trace&gt;[   44.617726] Call Trace:[   44.617926]  &lt;TASK&gt;[   44.619284]  userfaultfd_release+0xef/0x1b0[   44.620976]  __fput+0x3f9/0xb60[   44.621240]  fput_close_sync+0x110/0x210[   44.622222]  __x64_sys_close+0x8f/0x120[   44.622530]  do_syscall_64+0x5b/0x2f0[   44.622840]  entry_SYSCALL_64_after_hwframe+0x76/0x7e[   44.623244] RIP: 0033:0x7f365bb3f227Kernel panics because it detects UFFD inconsistency duringuserfaultfd_release_all().  Specifically, a VMA which has a valid pointerto vma-&gt;vm_userfaultfd_ctx, but no UFFD flags in vma-&gt;vm_flags.The inconsistency is caused in ksm_madvise(): when user calls madvise()with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,it accidentally clears all flags stored in the upper 32 bits ofvma-&gt;vm_flags.Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int andint are 32-bit wide.  This setup causes the following mishap during the &#38;=~VM_MERGEABLE assignment.VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000&#39;0000. After ~ is applied, it becomes 0x7fff&#39;ffff unsigned int, which is thenpromoted to unsigned long before the &#38; operation.  This promotion fillsupper 32 bits with leading 0s, as we&#39;re doing unsigned conversion (andeven for a signed conversion, this wouldn&#39;t help as the leading bit is 0).&#38; operation thus ends up AND-ing vm_flags with 0x0000&#39;0000&#39;7fff&#39;ffffinstead of intended 0xffff&#39;ffff&#39;7fff&#39;ffff and hence accidentally clearsthe upper 32-bits of its value.Fix it by changing `VM_MERGEABLE` constant to unsigned long, using theBIT() macro.Note: other VM_* flags are not affected: This only happens to theVM_MERGEABLE flag, as the other VM_* flags are all constants of type intand after ~ operation, they end up with leading 1 and are thus convertedto unsigned long with leading 1s.Note 2:After commit 31defc3b01d9 (&#34;userfaultfd: remove (VM_)BUG_ON()s&#34;), this isno longer a kernel BUG, but a WARNING at the same place:[   45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067but the root-cause (flag-drop) remains the same.[akpm@linux-foundation.org: rust bindgen wasn&#39;t able to handle BIT(), from Miguel]The Linux kernel CVE team has assigned CVE-2025-40040 to this issue.
 openEuler评分：
  5.8
 Vector：CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-24.03-LTS-SP2(6.6.0):受影响
4.openEuler-24.03-LTS-SP3(6.6.0):受影响
5.master(6.12.33):不受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响
9.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否
9.openEuler-24.03-LTS-SP3(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-24.03-LTS-SP3(6.6.0):正常修复
5.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
9.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

src-openEuler / kernel
Closed

Content Risk Flag

Comments (9)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-40040

Comments (9)

Search

src-openEuler / kernel
Closed