Skip to content
Heist/ feed
High

x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables. Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied. The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about "simply" clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong. So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation. Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process wil

Announced Source revision 1
Original source ↗

CVE-2025-22090

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-22090

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
        "lessThan": "a6623712ba8449876f0b3de9462831523fb851e4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
        "lessThan": "b07398e8a5da517083f5c3f2daa8f6681b48ab28",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
        "lessThan": "8d6373f83f367dbed316ddeb178130a3a64b5b67",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
        "lessThan": "da381c33f3aa6406406c9fdf07b8b0b63e0ce722",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
        "lessThan": "de6185b8892d88142ef69768fe4077cbf40109c0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
        "lessThan": "dc84bc2aba85a1508f04a936f9f9a15f64ebfb31",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "arch/x86/mm/pat/memtype.c",
      "include/linux/pgtable.h",
      "kernel/fork.c",
      "mm/memory.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.29"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.29",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.87",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.23",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13.11",
        "versionType": "semver",
        "lessThanOrEqual": "6.13.*"
      },
      {
        "status": "unaffected",
        "version": "6.14.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.14.*"
      },
      {
        "status": "unaffected",
        "version": "6.15",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "arch/x86/mm/pat/memtype.c",
      "include/linux/pgtable.h",
      "kernel/fork.c",
      "mm/memory.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-22090

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30460 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement