linux-cve-announce - CVE-2025-68231: mm/mempool: fix poisoning order>0 pages with HIGHMEM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025121636-CVE-2025-68231-74ba@gregkh>
Date: Tue, 16 Dec 2025 14:57:50 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-68231: mm/mempool: fix poisoning order>0 pages with HIGHMEM

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mm/mempool: fix poisoning order>0 pages with HIGHMEM

The kernel test has reported:

  BUG: unable to handle page fault for address: fffba000
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  *pde = 03171067 *pte = 00000000
  Oops: Oops: 0002 [#1]
  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE  a1d066dfe789f54bc7645c7989957d2bdee593ca
  Tainted: [T]=RANDSTRUCT
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)
  Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56
  EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b
  ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8
  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287
  CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690
  Call Trace:
   poison_element (mm/mempool.c:83 mm/mempool.c:102)
   mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)
   mempool_init_noprof (mm/mempool.c:250 (discriminator 1))
   ? mempool_alloc_pages (mm/mempool.c:640)
   bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))
   ? mempool_alloc_pages (mm/mempool.c:640)
   do_one_initcall (init/main.c:1283)

Christoph found out this is due to the poisoning code not dealing
properly with CONFIG_HIGHMEM because only the first page is mapped but
then the whole potentially high-order page is accessed.

We could give up on HIGHMEM here, but it's straightforward to fix this
with a loop that's mapping, poisoning or checking and unmapping
individual pages.

The Linux kernel CVE team has assigned CVE-2025-68231 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.1 with commit bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 and fixed in 6.1.159 with commit ea4131665107e66ece90e66bcec1a2f1246cbd41
	Issue introduced in 4.1 with commit bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 and fixed in 6.6.118 with commit 19de79aaea33ee1ea058c8711b3b2b4a7e4decd4
	Issue introduced in 4.1 with commit bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 and fixed in 6.12.60 with commit 6a13b56537e7b0d97f4bb74e8038ce471f9770d7
	Issue introduced in 4.1 with commit bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 and fixed in 6.17.10 with commit a79e49e1704367b635edad1479db23d7cf1fb71a
	Issue introduced in 4.1 with commit bdfedb76f4f5aa5e37380e3b71adee4a39f30fc6 and fixed in 6.18 with commit ec33b59542d96830e3c89845ff833cf7b25ef172

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-68231
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	mm/mempool.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ea4131665107e66ece90e66bcec1a2f1246cbd41
	https://git.kernel.org/stable/c/19de79aaea33ee1ea058c8711b3b2b4a7e4decd4
	https://git.kernel.org/stable/c/6a13b56537e7b0d97f4bb74e8038ce471f9770d7
	https://git.kernel.org/stable/c/a79e49e1704367b635edad1479db23d7cf1fb71a
	https://git.kernel.org/stable/c/ec33b59542d96830e3c89845ff833cf7b25ef172