{"id":"CVE-2025-39776","title":"kernel: mm/debug_vm_pgtable: clear page table entries at destroy_args() (CVE-2025-39776)","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/debug_vm_pgtable: clear page table entries at destroy_args()\n\nThe mm/debug_vm_pagetable test allocates manually page table entries for\nthe tests it runs, using also it…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-772","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 9"],"published":"2025-09-11","updated":"2026-10-16","sourceUpdated":"2026-10-16T23:24:02+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39776.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39776.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-39776"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394619"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-39776"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39776"},{"url":"https://lore.kernel.org/linux-cve-announce/2025091147-CVE-2025-39776-90c0@gregkh/T"},{"url":"https://git.kernel.org/stable/c/7bf57a0709cd7c9088cea8de023d6f4fbf2518b0"},{"url":"https://git.kernel.org/stable/c/47d2a149611b8a94d24add9868c442a4af278658"},{"url":"https://git.kernel.org/stable/c/63962ff932ef359925b94be2a88df6b4fd4fed0a"},{"url":"https://git.kernel.org/stable/c/61a9f2e5c49f05e3ea2c16674540a075a1b4be6f"},{"url":"https://git.kernel.org/stable/c/561171db3b3eb759ba3f284dba7a76f4476ade03"},{"url":"https://git.kernel.org/stable/c/dde30854bddfb5d69f30022b53c5955a41088b33"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00151,"epssPercentile":0.04175,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:54:00.606821Z"},"scores":{"vendor":5.5,"cna":7},"ingestedAt":"2026-10-15T22:48:25.522Z","slug":"CVE-2025-39776","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/debug_vm_pgtable: clear page table entries at destroy_args()\n\nThe mm/debug_vm_pagetable test allocates manually page table entries for\nthe tests it runs, using also its manually allocated mm_struct.  That in\nitself is ok, but when it exits, at destroy_args() it fails to clear those\nentries with the *_clear functions.\n\nThe problem is that leaves stale entries.  If another process allocates an\nmm_struct with a pgd at the same address, it may end up running into the\nstale entry.  This is happening in practice on a debug kernel with\nCONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra\ndebugging I added (it prints a warning trace if pgtables_bytes goes\nnegative, in addition to the warning at check_mm() function):\n\n[    2.539353] debug_vm_pgtable: [get_random_vaddr         ]: random_vaddr is 0x7ea247140000\n[    2.539366] kmem_cache info\n[    2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508\n[    2.539447] debug_vm_pgtable: [init_args                ]: args->mm is 0x000000002267cc9e\n(...)\n[    2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0\n[    2.552816] Modules linked in:\n[    2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY\n[    2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries\n[    2.552872] NIP:  c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90\n[    2.552885] REGS: c0000000622e73b0 TRAP: 0700   Not tainted  (6.12.0-105.debug_vm2.el10.ppc64le+debug)\n[    2.552899] MSR:  800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 24002822  XER: 0000000a\n[    2.552954] CFAR: c0000000008f03f0 IRQMASK: 0\n[    2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001\n[    2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff\n[    2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000\n[    2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb\n[    2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0\n[    2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000\n[    2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001\n[    2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760\n[    2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0\n[    2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0\n[    2.553199] Call Trace:\n[    2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable)\n[    2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0\n[    2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570\n[    2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650\n[    2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290\n[    2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0\n[    2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870\n[    2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150\n[    2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50\n[    2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0\n[    2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\n(...)\n[    2.558892] ---[ end trace 0000000000000000 ]---\n[    2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1\n[    2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144\n\nHere the modprobe process ended up with an allocated mm_struct from the\nmm_struct slab that was used before by the debug_vm_pgtable test.  That is\nnot a problem, since the mm_stru\n---truncated---\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39776.json)\n\n**kernel: mm/debug_vm_pgtable: clear page table entries at destroy_args()** — rated Low by Red Hat. Released 2025-09-11, updated 2026-10-16.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223566,"id":"CVE-2025-39776","ts":1792238317584,"field":"cvss","old":"7","new":"5.5"},{"seq":223565,"id":"CVE-2025-39776","ts":1792238317584,"field":"severity","old":"high","new":"medium"}]}