CVE-2025-40040

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40040", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.154Z", "datePublished": "2025-10-28T11:48:20.395Z", "dateUpdated": "2026-10-15T22:02:36.606Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:14.111Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix flag-dropping behavior in ksm_madvise\n\nsyzkaller discovered the following crash: (kernel BUG)\n\n[ 44.607039] ------------[ cut here ]------------\n[ 44.607422] kernel BUG at mm/userfaultfd.c:2067!\n[ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)\n[ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n<snip other registers, drop unreliable trace>\n\n[ 44.617726] Call Trace:\n[ 44.617926] <TASK>\n[ 44.619284] userfaultfd_release+0xef/0x1b0\n[ 44.620976] __fput+0x3f9/0xb60\n[ 44.621240] fput_close_sync+0x110/0x210\n[ 44.622222] __x64_sys_close+0x8f/0x120\n[ 44.622530] do_syscall_64+0x5b/0x2f0\n[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 44.623244] RIP: 0033:0x7f365bb3f227\n\nKernel panics because it detects UFFD inconsistency during\nuserfaultfd_release_all(). Specifically, a VMA which has a valid pointer\nto vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.\n\nThe inconsistency is caused in ksm_madvise(): when user calls madvise()\nwith MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,\nit accidentally clears all flags stored in the upper 32 bits of\nvma->vm_flags.\n\nAssuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and\nint are 32-bit wide. This setup causes the following mishap during the &=\n~VM_MERGEABLE assignment.\n\nVM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. \nAfter ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then\npromoted to unsigned long before the & operation. This promotion fills\nupper 32 bits with leading 0s, as we're doing unsigned conversion (and\neven for a signed conversion, this wouldn't help as the leading bit is 0).\n& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff\ninstead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears\nthe upper 32-bits of its value.\n\nFix it by changing `VM_MERGEABLE` constant to unsigned long, using the\nBIT() macro.\n\nNote: other VM_* flags are not affected: This only happens to the\nVM_MERGEABLE flag, as the other VM_* flags are all constants of type int\nand after ~ operation, they end up with leading 1 and are thus converted\nto unsigned long with leading 1s.\n\nNote 2:\nAfter commit 31defc3b01d9 (\"userfaultfd: remove (VM_)BUG_ON()s\"), this is\nno longer a kernel BUG, but a WARNING at the same place:\n\n[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067\n\nbut the root-cause (flag-drop) remains the same.\n\n[akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached purely through the madvise(2) syscall (MADV_MERGEABLE/MADV_UNMERGEABLE) on the caller's own address space, with no network or remote component. Local access to the system is required.\nAC:L - The flag drop is a deterministic C integer-promotion defect that triggers on every MADV_UNMERGEABLE call \u2014 no race, no memory-layout grooming, and no conditions outside the attacker's control. A short single-threaded reproducer (memfd + MAP_PRIVATE + MADV_MERGEABLE + UFFDIO_REGISTER(MINOR) + MADV_UNMERGEABLE + close) works 100% of the time.\nPR:L - Any unprivileged local user can do this: memfd_create() and MAP_PRIVATE need no capability, and userfaultfd(UFFD_USER_MODE_ONLY) is explicitly allowed to unprivileged callers regardless of vm.unprivileged_userfaultfd or CAP_SYS_PTRACE. The mseal/pkey/shadow-stack flag-drop variants need no special facility at all.\nUI:N - The attacking process performs the entire sequence itself via its own syscalls; no other user or administrator has to open a file, mount anything, or take any action.\nS:U - The corrupted state is the attacker's own VMA flags and the resulting crash or protection loss stays within the kernel and the process's own address space, without crossing into a hypervisor, IOMMU, or other security authority.\nC:H - Clearing VM_PKEY_BIT0..4 makes vma_pkey() return 0 and drops _PAGE_PKEY_* from the recomputed page protection, silently revoking MPK-based isolation so an untrusted in-process component can read memory it was walled off from; combined with the VM_SEALED drop (allowing mremap of regions the policy pinned) this yields disclosure of memory the kernel was supposed to keep protected.\nI:H - The wipe silently revokes kernel-enforced write protections: VM_SEALED loss is a full mseal(2) bypass (sealed code/GOT regions become mprotect-able and munmap-able), and VM_SHADOW_STACK loss lets userspace write its own CET shadow stack, defeating control-flow integrity and enabling ROP \u2014 memory the kernel guaranteed immutable becomes attacker-writable.\nA:H - Dropping VM_UFFD_MINOR while leaving vma->vm_userfaultfd_ctx set creates the inconsistency that userfaultfd_release_all() asserts on, producing a kernel BUG()/invalid-opcode panic on close() (a WARNING at mm/userfaultfd.c:2067 after 31defc3b01d9, still fatal under panic_on_warn). Any local user can trigger this at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/mm.h", "rust/bindings/bindings_helper.h"], "versions": [{"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71", "status": "affected", "versionType": "git"}, {"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "788e5385d0ff69cdba1cabccb9dab8d9647b9239", "status": "affected", "versionType": "git"}, {"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "b69f19244c2b6475c8a6eb72f0fb0d53509e48cd", "status": "affected", "versionType": "git"}, {"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693", "status": "affected", "versionType": "git"}, {"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "92b82e232b8d8b116ac6e57aeae7a6033db92c60", "status": "affected", "versionType": "git"}, {"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "ac50c6e0a8f91a02b681af81abb2362fbb67cc18", "status": "affected", "versionType": "git"}, {"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "76385629f45740b7888f8fcd83bde955b10f61fe", "status": "affected", "versionType": "git"}, {"version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/mm.h", "rust/bindings/bindings_helper.h"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.302", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.247", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.197", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.158", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.114", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.55", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.4.302"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.10.247"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.197"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71"}, {"url": "https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239"}, {"url": "https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd"}, {"url": "https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693"}, {"url": "https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60"}, {"url": "https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18"}, {"url": "https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe"}, {"url": "https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93"}], "title": "mm/ksm: fix flag-dropping behavior in ksm_madvise", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40040", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:21.086400Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:36.606Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40040", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:21.086400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:56:21.660Z"}}], "cna": {"title": "mm/ksm: fix flag-dropping behavior in ksm_madvise", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached purely through the madvise(2) syscall (MADV_MERGEABLE/MADV_UNMERGEABLE) on the caller's own address space, with no network or remote component. Local access to the system is required.\nAC:L - The flag drop is a deterministic C integer-promotion defect that triggers on every MADV_UNMERGEABLE call \u2014 no race, no memory-layout grooming, and no conditions outside the attacker's control. A short single-threaded reproducer (memfd + MAP_PRIVATE + MADV_MERGEABLE + UFFDIO_REGISTER(MINOR) + MADV_UNMERGEABLE + close) works 100% of the time.\nPR:L - Any unprivileged local user can do this: memfd_create() and MAP_PRIVATE need no capability, and userfaultfd(UFFD_USER_MODE_ONLY) is explicitly allowed to unprivileged callers regardless of vm.unprivileged_userfaultfd or CAP_SYS_PTRACE. The mseal/pkey/shadow-stack flag-drop variants need no special facility at all.\nUI:N - The attacking process performs the entire sequence itself via its own syscalls; no other user or administrator has to open a file, mount anything, or take any action.\nS:U - The corrupted state is the attacker's own VMA flags and the resulting crash or protection loss stays within the kernel and the process's own address space, without crossing into a hypervisor, IOMMU, or other security authority.\nC:H - Clearing VM_PKEY_BIT0..4 makes vma_pkey() return 0 and drops _PAGE_PKEY_* from the recomputed page protection, silently revoking MPK-based isolation so an untrusted in-process component can read memory it was walled off from; combined with the VM_SEALED drop (allowing mremap of regions the policy pinned) this yields disclosure of memory the kernel was supposed to keep protected.\nI:H - The wipe silently revokes kernel-enforced write protections: VM_SEALED loss is a full mseal(2) bypass (sealed code/GOT regions become mprotect-able and munmap-able), and VM_SHADOW_STACK loss lets userspace write its own CET shadow stack, defeating control-flow integrity and enabling ROP \u2014 memory the kernel guaranteed immutable becomes attacker-writable.\nA:H - Dropping VM_UFFD_MINOR while leaving vma->vm_userfaultfd_ctx set creates the inconsistency that userfaultfd_release_all() asserts on, producing a kernel BUG()/invalid-opcode panic on close() (a WARNING at mm/userfaultfd.c:2067 after 31defc3b01d9, still fatal under panic_on_warn). Any local user can trigger this at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71", "versionType": "git"}, {"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "788e5385d0ff69cdba1cabccb9dab8d9647b9239", "versionType": "git"}, {"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "b69f19244c2b6475c8a6eb72f0fb0d53509e48cd", "versionType": "git"}, {"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693", "versionType": "git"}, {"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "92b82e232b8d8b116ac6e57aeae7a6033db92c60", "versionType": "git"}, {"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "ac50c6e0a8f91a02b681af81abb2362fbb67cc18", "versionType": "git"}, {"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "76385629f45740b7888f8fcd83bde955b10f61fe", "versionType": "git"}, {"status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "lessThan": "f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93", "versionType": "git"}], "programFiles": ["include/linux/mm.h", "rust/bindings/bindings_helper.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"status": "unaffected", "version": "0", "lessThan": "4.6", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.302", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.247", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.197", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.158", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.114", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.55", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.3", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/mm.h", "rust/bindings/bindings_helper.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71"}, {"url": "https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239"}, {"url": "https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd"}, {"url": "https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693"}, {"url": "https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60"}, {"url": "https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18"}, {"url": "https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe"}, {"url": "https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix flag-dropping behavior in ksm_madvise\n\nsyzkaller discovered the following crash: (kernel BUG)\n\n[ 44.607039] ------------[ cut here ]------------\n[ 44.607422] kernel BUG at mm/userfaultfd.c:2067!\n[ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)\n[ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n<snip other registers, drop unreliable trace>\n\n[ 44.617726] Call Trace:\n[ 44.617926] <TASK>\n[ 44.619284] userfaultfd_release+0xef/0x1b0\n[ 44.620976] __fput+0x3f9/0xb60\n[ 44.621240] fput_close_sync+0x110/0x210\n[ 44.622222] __x64_sys_close+0x8f/0x120\n[ 44.622530] do_syscall_64+0x5b/0x2f0\n[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 44.623244] RIP: 0033:0x7f365bb3f227\n\nKernel panics because it detects UFFD inconsistency during\nuserfaultfd_release_all(). Specifically, a VMA which has a valid pointer\nto vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.\n\nThe inconsistency is caused in ksm_madvise(): when user calls madvise()\nwith MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,\nit accidentally clears all flags stored in the upper 32 bits of\nvma->vm_flags.\n\nAssuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and\nint are 32-bit wide. This setup causes the following mishap during the &=\n~VM_MERGEABLE assignment.\n\nVM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. \nAfter ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then\npromoted to unsigned long before the & operation. This promotion fills\nupper 32 bits with leading 0s, as we're doing unsigned conversion (and\neven for a signed conversion, this wouldn't help as the leading bit is 0).\n& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff\ninstead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears\nthe upper 32-bits of its value.\n\nFix it by changing `VM_MERGEABLE` constant to unsigned long, using the\nBIT() macro.\n\nNote: other VM_* flags are not affected: This only happens to the\nVM_MERGEABLE flag, as the other VM_* flags are all constants of type int\nand after ~ operation, they end up with leading 1 and are thus converted\nto unsigned long with leading 1s.\n\nNote 2:\nAfter commit 31defc3b01d9 (\"userfaultfd: remove (VM_)BUG_ON()s\"), this is\nno longer a kernel BUG, but a WARNING at the same place:\n\n[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067\n\nbut the root-cause (flag-drop) remains the same.\n\n[akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.302", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.247", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.197", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.158", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.114", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.55", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.3", "versionStartIncluding": "4.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "4.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:14.111Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40040", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:36.606Z", "dateReserved": "2025-04-16T07:20:57.154Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-28T11:48:20.395Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/mm.h", "rust/bindings/bindings_helper.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}, {"lessThan": "788e5385d0ff69cdba1cabccb9dab8d9647b9239", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}, {"lessThan": "b69f19244c2b6475c8a6eb72f0fb0d53509e48cd", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}, {"lessThan": "41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}, {"lessThan": "92b82e232b8d8b116ac6e57aeae7a6033db92c60", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}, {"lessThan": "ac50c6e0a8f91a02b681af81abb2362fbb67cc18", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}, {"lessThan": "76385629f45740b7888f8fcd83bde955b10f61fe", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}, {"lessThan": "f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93", "status": "affected", "version": "63c17fb8e5a46a16e10e82005748837fd11a2024", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/mm.h", "rust/bindings/bindings_helper.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.302", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.247", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.197", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.158", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.114", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.55", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92D7EAC7-85AD-4A59-982E-28696A9CB495", "versionEndExcluding": "5.4.302", "versionStartIncluding": "4.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE19816A-13B7-4862-B963-A4DF36CA766A", "versionEndExcluding": "5.10.247", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "06E8A34D-C8D8-461A-B8F8-0E420CC5E116", "versionEndExcluding": "5.15.197", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "77B0D8DC-487F-497A-8C89-E7C8F6427586", "versionEndExcluding": "6.1.158", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4EB737C8-40A2-4187-8371-FFB0D2615B8B", "versionEndExcluding": "6.6.114", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "516AE9B7-F899-4BF2-A81C-BAB0A37671FA", "versionEndExcluding": "6.12.55", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F55A160F-1578-4C10-ABCB-F90B7E146ED8", "versionEndExcluding": "6.17.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix flag-dropping behavior in ksm_madvise\n\nsyzkaller discovered the following crash: (kernel BUG)\n\n[ 44.607039] ------------[ cut here ]------------\n[ 44.607422] kernel BUG at mm/userfaultfd.c:2067!\n[ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)\n[ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n<snip other registers, drop unreliable trace>\n\n[ 44.617726] Call Trace:\n[ 44.617926] <TASK>\n[ 44.619284] userfaultfd_release+0xef/0x1b0\n[ 44.620976] __fput+0x3f9/0xb60\n[ 44.621240] fput_close_sync+0x110/0x210\n[ 44.622222] __x64_sys_close+0x8f/0x120\n[ 44.622530] do_syscall_64+0x5b/0x2f0\n[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 44.623244] RIP: 0033:0x7f365bb3f227\n\nKernel panics because it detects UFFD inconsistency during\nuserfaultfd_release_all(). Specifically, a VMA which has a valid pointer\nto vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.\n\nThe inconsistency is caused in ksm_madvise(): when user calls madvise()\nwith MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,\nit accidentally clears all flags stored in the upper 32 bits of\nvma->vm_flags.\n\nAssuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and\nint are 32-bit wide. This setup causes the following mishap during the &=\n~VM_MERGEABLE assignment.\n\nVM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. \nAfter ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then\npromoted to unsigned long before the & operation. This promotion fills\nupper 32 bits with leading 0s, as we're doing unsigned conversion (and\neven for a signed conversion, this wouldn't help as the leading bit is 0).\n& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff\ninstead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears\nthe upper 32-bits of its value.\n\nFix it by changing `VM_MERGEABLE` constant to unsigned long, using the\nBIT() macro.\n\nNote: other VM_* flags are not affected: This only happens to the\nVM_MERGEABLE flag, as the other VM_* flags are all constants of type int\nand after ~ operation, they end up with leading 1 and are thus converted\nto unsigned long with leading 1s.\n\nNote 2:\nAfter commit 31defc3b01d9 (\"userfaultfd: remove (VM_)BUG_ON()s\"), this is\nno longer a kernel BUG, but a WARNING at the same place:\n\n[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067\n\nbut the root-cause (flag-drop) remains the same.\n\n[akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/ksm: corrige el comportamiento de eliminaci\u00f3n de banderas en ksm_madvise\n\nsyzkaller descubri\u00f3 el siguiente fallo: (BUG del kernel)\n\n[ 44.607039] ------------[ cortar aqu\u00ed ]------------\n[ 44.607422] BUG del kernel en mm/userfaultfd.c:2067!\n[ 44.608148] Oops: c\u00f3digo de operaci\u00f3n inv\u00e1lido: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproductor No contaminado 6.16.0-rc6 #1 PREEMPT(none)\n[ 44.609635] Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n<se omiten otros registros, se descarta el rastreo no fiable>\n\n[ 44.617726] Rastreo de Llamadas:\n[ 44.617926] <TAREA>\n[ 44.619284] userfaultfd_release+0xef/0x1b0\n[ 44.620976] __fput+0x3f9/0xb60\n[ 44.621240] fput_close_sync+0x110/0x210\n[ 44.622222] __x64_sys_close+0x8f/0x120\n[ 44.622530] do_syscall_64+0x5b/0x2f0\n[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 44.623244] RIP: 0033:0x7f365bb3f227\n\nEl kernel entra en p\u00e1nico porque detecta una inconsistencia de UFFD durante userfaultfd_release_all(). Espec\u00edficamente, un VMA que tiene un puntero v\u00e1lido a vma->vm_userfaultfd_ctx, pero sin banderas UFFD en vma->vm_flags.\n\nLa inconsistencia es causada en ksm_madvise(): cuando el usuario llama a madvise() con MADV_UNMEARGEABLE en un VMA que est\u00e1 registrado para UFFD en modo MINOR, borra accidentalmente todas las banderas almacenadas en los 32 bits superiores de vma->vm_flags.\n\nAsumiendo una compilaci\u00f3n del kernel x86_64, unsigned long es de 64 bits y unsigned int e int son de 32 bits de ancho. Esta configuraci\u00f3n causa el siguiente percance durante la asignaci\u00f3n &= ~VM_MERGEABLE.\n\nVM_MERGEABLE es una constante de 32 bits de tipo unsigned int, 0x8000'0000. Despu\u00e9s de aplicar ~, se convierte en 0x7fff'ffff unsigned int, que luego se promociona a unsigned long antes de la operaci\u00f3n &. Esta promoci\u00f3n llena los 32 bits superiores con ceros iniciales, ya que estamos haciendo una conversi\u00f3n sin signo (e incluso para una conversi\u00f3n con signo, esto no ayudar\u00eda ya que el bit inicial es 0). La operaci\u00f3n & termina haciendo un AND de vm_flags con 0x0000'0000'7fff'ffff en lugar del 0xffff'ffff'7fff'ffff previsto y, por lo tanto, borra accidentalmente los 32 bits superiores de su valor.\n\nCorr\u00edgelo cambiando la constante VM_MERGEABLE a unsigned long, usando la macro BIT().\n\nNota: otras banderas VM_* no se ven afectadas: Esto solo le ocurre a la bandera VM_MERGEABLE, ya que las otras banderas VM_* son todas constantes de tipo int y despu\u00e9s de la operaci\u00f3n ~, terminan con un 1 inicial y por lo tanto se convierten a unsigned long con 1s iniciales.\n\nNota 2:\nDespu\u00e9s del commit 31defc3b01d9 ('userfaultfd: remove (VM_)BUG_ON()s'), esto ya no es un BUG del kernel, sino una ADVERTENCIA en el mismo lugar:\n\n[ 45.595973] ADVERTENCIA: CPU: 1 PID: 2474 en mm/userfaultfd.c:2067\n\npero la causa ra\u00edz (eliminaci\u00f3n de bandera) sigue siendo la misma.\n\n[akpm@linux-foundation.org: rust bindgen no pudo manejar BIT(), de Miguel]"}], "id": "CVE-2025-40040", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40040", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:56:21.086400Z", "version": "2.0.3"}}]}, "published": "2025-10-28T12:15:37.967", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/ksm: fix flag-dropping behavior in ksm_madvise", "id": "2406730", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406730"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40040", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40040\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40040\nhttps://lore.kernel.org/linux-cve-announce/2025102812-CVE-2025-40040-943a@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-29T10:58:02.859512+00:00", "updated": "2025-10-29T10:58:02.859538+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}