CVE-2025-39754: mm/smaps: fix race between smaps_hugetlb_range and migration

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-11 · updated 2026-10-30
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). The race is as follows. smaps_hugetlb_range migrate_pages huge_ptep_get remove_migration_ptes folio_unlock pfn_swap_entry_folio BUG_ON To fix it, hold ptl lock in smaps_hugetlb_range().

Affected products

Linux kernel: from 4.4 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2; 6.17-rc1 — fixed in 6.12.43, 6.15.11, 6.16.2
Linux: 4.4 — fixed in 6.17

How to fix

Upgrade to a fixed version: Linux kernel 6.12.43, 6.15.11, 6.16.2; Linux 6.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-39754 or the next vulnerability affects your stack