CVE-2025-68211

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68211", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.256Z", "datePublished": "2025-12-16T13:48:37.959Z", "dateUpdated": "2026-06-11T18:44:19.687Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:48:52.139Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages. This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range(). The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups. This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include <unistd.h>\n#include <stdio.h>\n#include <sys/mman.h>\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n if (area == MAP_FAILED) {\n perror(\"mmap() failed\\n\");\n return -1;\n }\n\n /* Populate a single page such that we get an anon_vma. */\n *area = 0;\n\n /* Enable KSM. */\n madvise(area, size, MADV_MERGEABLE);\n pause();\n return 0;\n}\n\n$ ./ksm-sparse &\n$ echo 1 > /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page. This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value. With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/ksm.c"], "versions": [{"version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "220cb3e425e17587f560335924cba9f16a842c64", "status": "affected", "versionType": "git"}, {"version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "10644e8839544dd5699c03c8fb1aeeefc41602fd", "status": "affected", "versionType": "git"}, {"version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "67137b715b7db28d82e4ed07a7092c2fa6ba7adb", "status": "affected", "versionType": "git"}, {"version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "9c2f8a9b68024e5ebb4813665845ec0a95f2eac3", "status": "affected", "versionType": "git"}, {"version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "74f78421c925b6d17695566f0c5941de57fd44b3", "status": "affected", "versionType": "git"}, {"version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "f62973e0767e4fcd6799087787fca08ca2a85b8c", "status": "affected", "versionType": "git"}, {"version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "f5548c318d6520d4fa3c5ed6003eeb710763cbc5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/ksm.c"], "versions": [{"version": "2.6.32", "status": "affected"}, {"version": "0", "lessThan": "2.6.32", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.249", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.199", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.161", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.121", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.59", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.9", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "5.10.249"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "5.15.199"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.1.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.6.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.12.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.17.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/220cb3e425e17587f560335924cba9f16a842c64"}, {"url": "https://git.kernel.org/stable/c/10644e8839544dd5699c03c8fb1aeeefc41602fd"}, {"url": "https://git.kernel.org/stable/c/67137b715b7db28d82e4ed07a7092c2fa6ba7adb"}, {"url": "https://git.kernel.org/stable/c/9c2f8a9b68024e5ebb4813665845ec0a95f2eac3"}, {"url": "https://git.kernel.org/stable/c/74f78421c925b6d17695566f0c5941de57fd44b3"}, {"url": "https://git.kernel.org/stable/c/f62973e0767e4fcd6799087787fca08ca2a85b8c"}, {"url": "https://git.kernel.org/stable/c/f5548c318d6520d4fa3c5ed6003eeb710763cbc5"}], "title": "ksm: use range-walk function to jump over holes in scan_get_next_rmap_item", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68211", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T20:42:07.997005Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T18:44:19.687Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68211", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T20:42:07.997005Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T17:39:05.309Z"}}], "cna": {"title": "ksm: use range-walk function to jump over holes in scan_get_next_rmap_item", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "220cb3e425e17587f560335924cba9f16a842c64", "versionType": "git"}, {"status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "10644e8839544dd5699c03c8fb1aeeefc41602fd", "versionType": "git"}, {"status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "67137b715b7db28d82e4ed07a7092c2fa6ba7adb", "versionType": "git"}, {"status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "9c2f8a9b68024e5ebb4813665845ec0a95f2eac3", "versionType": "git"}, {"status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "74f78421c925b6d17695566f0c5941de57fd44b3", "versionType": "git"}, {"status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "f62973e0767e4fcd6799087787fca08ca2a85b8c", "versionType": "git"}, {"status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "lessThan": "f5548c318d6520d4fa3c5ed6003eeb710763cbc5", "versionType": "git"}], "programFiles": ["mm/ksm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.32"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.32", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.249", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.199", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.161", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.121", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.59", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.9", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/ksm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/220cb3e425e17587f560335924cba9f16a842c64"}, {"url": "https://git.kernel.org/stable/c/10644e8839544dd5699c03c8fb1aeeefc41602fd"}, {"url": "https://git.kernel.org/stable/c/67137b715b7db28d82e4ed07a7092c2fa6ba7adb"}, {"url": "https://git.kernel.org/stable/c/9c2f8a9b68024e5ebb4813665845ec0a95f2eac3"}, {"url": "https://git.kernel.org/stable/c/74f78421c925b6d17695566f0c5941de57fd44b3"}, {"url": "https://git.kernel.org/stable/c/f62973e0767e4fcd6799087787fca08ca2a85b8c"}, {"url": "https://git.kernel.org/stable/c/f5548c318d6520d4fa3c5ed6003eeb710763cbc5"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages. This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range(). The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups. This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include <unistd.h>\n#include <stdio.h>\n#include <sys/mman.h>\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n if (area == MAP_FAILED) {\n perror(\"mmap() failed\\n\");\n return -1;\n }\n\n /* Populate a single page such that we get an anon_vma. */\n *area = 0;\n\n /* Enable KSM. */\n madvise(area, size, MADV_MERGEABLE);\n pause();\n return 0;\n}\n\n$ ./ksm-sparse &\n$ echo 1 > /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page. This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value. With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.249", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.199", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.161", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.121", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.59", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.9", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "2.6.32"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:48:52.139Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68211", "state": "PUBLISHED", "dateUpdated": "2026-06-11T18:44:19.687Z", "dateReserved": "2025-12-16T13:41:40.256Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-16T13:48:37.959Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/ksm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "220cb3e425e17587f560335924cba9f16a842c64", "status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "versionType": "git"}, {"lessThan": "10644e8839544dd5699c03c8fb1aeeefc41602fd", "status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "versionType": "git"}, {"lessThan": "67137b715b7db28d82e4ed07a7092c2fa6ba7adb", "status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "versionType": "git"}, {"lessThan": "9c2f8a9b68024e5ebb4813665845ec0a95f2eac3", "status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "versionType": "git"}, {"lessThan": "74f78421c925b6d17695566f0c5941de57fd44b3", "status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "versionType": "git"}, {"lessThan": "f62973e0767e4fcd6799087787fca08ca2a85b8c", "status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "versionType": "git"}, {"lessThan": "f5548c318d6520d4fa3c5ed6003eeb710763cbc5", "status": "affected", "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/ksm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.32"}, {"lessThan": "2.6.32", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.249", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.199", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.161", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.121", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.59", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B007F439-6EEB-48A9-8FE9-4911DB2F7763", "versionEndExcluding": "5.10.249", "versionStartIncluding": "2.6.32", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A247FBA6-BEB9-484F-B892-DD5517949CCD", "versionEndExcluding": "5.15.199", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E135B7E2-61FC-4DC1-8570-ABD67894FFDE", "versionEndExcluding": "6.1.161", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB7A164B-7422-4A1C-82FB-5FCAEE53C06C", "versionEndExcluding": "6.6.121", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F31B9755-3C98-42CB-8006-0DF32DCD5AF5", "versionEndExcluding": "6.12.59", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "02A34EC6-429C-4CA9-BF4C-09313652458E", "versionEndExcluding": "6.17.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc1:*:*:*:*:*:*", "matchCriteriaId": "DD01661D-DFC8-4B6D-80E7-46D203CC4565", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*", "matchCriteriaId": "A8A65C5A-918F-4E0B-8E98-08A29FFBA58A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*", "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*", "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*", "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages. This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range(). The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups. This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include <unistd.h>\n#include <stdio.h>\n#include <sys/mman.h>\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n if (area == MAP_FAILED) {\n perror(\"mmap() failed\\n\");\n return -1;\n }\n\n /* Populate a single page such that we get an anon_vma. */\n *area = 0;\n\n /* Enable KSM. */\n madvise(area, size, MADV_MERGEABLE);\n pause();\n return 0;\n}\n\n$ ./ksm-sparse &\n$ echo 1 > /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page. This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value. With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksm: usar la funci\u00f3n de recorrido de rango para saltar sobre los huecos en scan_get_next_rmap_item\n\nActualmente, scan_get_next_rmap_item() recorre cada direcci\u00f3n de p\u00e1gina en un VMA para localizar p\u00e1ginas fusionables. Esto se vuelve altamente ineficiente al escanear grandes \u00e1reas de memoria virtual que contienen en su mayor\u00eda regiones no mapeadas, lo que hace que ksmd use una gran cantidad de CPU sin desduplicar muchas p\u00e1ginas.\n\nEste parche reemplaza la b\u00fasqueda por direcci\u00f3n con un recorrido de rango usando walk_page_range(). El recorredor de rangos permite a KSM saltar sobre huecos no mapeados completos en un VMA, evitando b\u00fasquedas innecesarias. Este problema fue discutido previamente en [1].\n\nConsidere el siguiente programa de prueba que crea un mapeo de 32 TiB en el espacio de direcciones virtual pero solo rellena una \u00fanica p\u00e1gina:\n\n#include <unistd.h>\n#include <stdio.h>\n#include <sys/mman.h>\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n char area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n if (area == MAP_FAILED) {\n perror(\u201cmmap() failed\\n\u201d);\n return -1;\n }\n\n /* Populate a single page such that we get an anon_vma. */\n area = 0;\n\n /* Enable KSM. */\n madvise(area, size, MADV_MERGEABLE);\n pause();\n return 0;\n}\n\n$ ./ksm-sparse &\n$ echo 1 > /sys/kernel/mm/ksm/run \n\nSin este parche, ksmd usa el 100% de la CPU durante mucho tiempo (m\u00e1s de 1 hora en mi m\u00e1quina de prueba) escaneando todo el espacio de direcciones virtual de 32 TiB que contiene solo una p\u00e1gina mapeada. Esto hace que ksmd quede esencialmente bloqueado sin poder desduplicar nada de valor. Con este parche, ksmd recorre solo la p\u00e1gina mapeada y salta el resto del espacio de direcciones virtual de 32 TiB, haciendo que el escaneo sea r\u00e1pido usando poca CPU."}], "id": "CVE-2025-68211", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68211", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T20:42:07.997005Z", "version": "2.0.3"}}]}, "published": "2025-12-16T14:15:54.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/10644e8839544dd5699c03c8fb1aeeefc41602fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/220cb3e425e17587f560335924cba9f16a842c64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/67137b715b7db28d82e4ed07a7092c2fa6ba7adb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/74f78421c925b6d17695566f0c5941de57fd44b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9c2f8a9b68024e5ebb4813665845ec0a95f2eac3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f5548c318d6520d4fa3c5ed6003eeb710763cbc5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f62973e0767e4fcd6799087787fca08ca2a85b8c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item", "id": "2422696", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422696"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68211", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68211\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68211\nhttps://lore.kernel.org/linux-cve-announce/2025121634-CVE-2025-68211-180a@gregkh/T"], "threat_severity": "Moderate"}

{}