linux-cve-announce - CVE-2025-38364: maple_tree: fix MA_STATE_PREALLOC flag in mas

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072558-CVE-2025-38364-74db@gregkh>
Date: Fri, 25 Jul 2025 14:48:05 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38364: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()

Temporarily clear the preallocation flag when explicitly requesting
allocations.  Pre-existing allocations are already counted against the
request through mas_node_count_gfp(), but the allocations will not happen
if the MA_STATE_PREALLOC flag is set.  This flag is meant to avoid
re-allocating in bulk allocation mode, and to detect issues with
preallocation calculations.

The MA_STATE_PREALLOC flag should also always be set on zero allocations
so that detection of underflow allocations will print a WARN_ON() during
consumption.

User visible effect of this flaw is a WARN_ON() followed by a null pointer
dereference when subsequent requests for larger number of nodes is
ignored, such as the vma merge retry in mmap_region() caused by drivers
altering the vma flags (which happens in v6.6, at least)

The Linux kernel CVE team has assigned CVE-2025-38364 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.1.146 with commit d69cd64bd5af41c6fd409313504089970edaf02f
	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.6.99 with commit e63032e66bca1d06e600033f3369ba3db3af0870
	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.12.36 with commit cf95f8426f889949b738f51ffcd72884411f3a6a
	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.15.5 with commit 9e32f4700867abbd5d19abfcf698dbd0d2ce36a4
	Issue introduced in 6.1 with commit 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa and fixed in 6.16-rc4 with commit fba46a5d83ca8decb338722fb4899026d8d9ead2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38364
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	lib/maple_tree.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d69cd64bd5af41c6fd409313504089970edaf02f
	https://git.kernel.org/stable/c/e63032e66bca1d06e600033f3369ba3db3af0870
	https://git.kernel.org/stable/c/cf95f8426f889949b738f51ffcd72884411f3a6a
	https://git.kernel.org/stable/c/9e32f4700867abbd5d19abfcf698dbd0d2ce36a4
	https://git.kernel.org/stable/c/fba46a5d83ca8decb338722fb4899026d8d9ead2