CVE-2025-39754— mm/smaps: fix race between smaps_hugetlb_range and migration
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于smaps_hugetlb_range未持有ptl锁，可能与迁移操作产生竞争条件，导致pfn_swap_entry_to_page中出现BUG_ON。
Possible ATT&CK Techniques 1 AI
T1047 · Windows Management InstrumentationAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 25ee01a2fca02dfb5a3ce316e77910c468108199< f76089018b34dbe0c2e9b67c5b7d8860668748bb |
affected |
25ee01a2fca02dfb5a3ce316e77910c468108199< 2a1f3663974162b8f1e098196f557cfc1d160138 |
affected | ||
25ee01a2fca02dfb5a3ce316e77910c468108199< 09fc018f48871123ad5dbd7b03c956580232ed76 |
affected | ||
25ee01a2fca02dfb5a3ce316e77910c468108199< b625883ccbcc2b57808db51d1375b1d7b9bcb3e5 |
affected | ||
25ee01a2fca02dfb5a3ce316e77910c468108199< 45d19b4b6c2d422771c29b83462d84afcbb33f01 |
affected | ||
4.4 |
affected | ||
< 4.4 |
unaffected | ||
6.6.160≤ 6.6.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-39754
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mm/smaps: fix race between smaps_hugetlb_range and migration
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mm/smaps: fix race between smaps_hugetlb_range and migration
smaps_hugetlb_range() handles the pte without holdling ptl, and may be
concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page().
The race is as follows.
smaps_hugetlb_range migrate_pages
huge_ptep_get
remove_migration_ptes
folio_unlock
pfn_swap_entry_folio
BUG_ON
To fix it, hold ptl lock in smaps_hugetlb_range().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于smaps_hugetlb_range未持有ptl锁，可能与迁移操作产生竞争条件，导致pfn_swap_entry_to_page中出现BUG_ON。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39754
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39754
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-11 · 54 CVEs total
| CVE-2025-39758 | 9.8 CRITICAL | RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages |
| CVE-2025-39761 | 8.8 HIGH | wifi: ath12k: Decrement TID on RX peer frag setup error handling |
| CVE-2025-39750 | 8.8 HIGH | wifi: ath12k: Correct tid cleanup when tid setup fails |
| CVE-2025-39790 | 8.4 HIGH | bus: mhi: host: Detect events pointing to unexpected TREs |
| CVE-2025-39779 | 7.8 HIGH | btrfs: subpage: keep TOWRITE tag until folio is cleaned |
| CVE-2025-39785 | 7.8 HIGH | drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local |
| CVE-2025-39786 | 7.8 HIGH | iio: adc: ad7173: fix channels index for syscalib_mode |
| CVE-2025-39787 | 7.8 HIGH | soc: qcom: mdt_loader: Ensure we don't read past the ELF header |
| CVE-2025-39740 | 7.8 HIGH | drm/xe/migrate: prevent potential UAF |
| CVE-2025-39780 | 7.8 HIGH | sched/ext: Fix invalid task state transitions on class switch |
| CVE-2025-39791 | 7.8 HIGH | dm: dm-crypt: Do not partially accept write BIOs with zoned targets |
| CVE-2025-39770 | 7.5 HIGH | net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM |
| CVE-2025-39738 | 7.3 HIGH | btrfs: do not allow relocation of partially dropped subvolumes |
| CVE-2025-39789 | 7.3 HIGH | crypto: x86/aegis - Add missing error checks |
| CVE-2025-39776 | 7.0 HIGH | mm/debug_vm_pgtable: clear page table entries at destroy_args() |
| CVE-2025-39784 | PCI: Fix link speed calculation on retrain failure | |
| CVE-2025-39782 | jbd2: prevent softlockup in jbd2_log_do_checkpoint() | |
| CVE-2025-39772 | drm/hisilicon/hibmc: fix the hibmc loaded failed bug | |
| CVE-2025-39771 | regulator: pca9450: Use devm_register_sys_off_handler | |
| CVE-2025-39773 | net: bridge: fix soft lockup in br_multicast_query_expired() |
Showing top 20 of 54 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2025-39754
No comments yet