CVE-2025-68248 (GCVE-0-2025-68248)

Vulnerability from cvelistv5 – Published: 2025-12-16 14:32 – Updated: 2026-05-11 21:49
VLAI
Title
vmw_balloon: indicate success when effectively deflating during migration
Summary
In the Linux kernel, the following vulnerability has been resolved: vmw_balloon: indicate success when effectively deflating during migration When migrating a balloon page, we first deflate the old page to then inflate the new page. However, if inflating the new page succeeded, we effectively deflated the old page, reducing the balloon size. In that case, the migration actually worked: similar to migrating+ immediately deflating the new page. The old page will be freed back to the buddy. Right now, the core will leave the page be marked as isolated (as we returned an error). When later trying to putback that page, we will run into the WARN_ON_ONCE() in balloon_page_putback(). That handling was changed in commit 3544c4faccb8 ("mm/balloon_compaction: stop using __ClearPageMovable()"); before that change, we would have tolerated that way of handling it. To fix it, let's just return 0 in that case, making the core effectively just clear the "isolated" flag + freeing it back to the buddy as if the migration succeeded. Note that the new page will also get freed when the core puts the last reference. Note that this also makes it all be more consistent: we will no longer unisolate the page in the balloon driver while keeping it marked as being isolated in migration core. This was found by code inspection.
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6664 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3544c4faccb8f0867bc65f8007ee70bfb5054305 , < aa05a044c5c2e147d726ac2fae1a97e0775eac11 (git)
Affected: 3544c4faccb8f0867bc65f8007ee70bfb5054305 , < 4ba5a8a7faa647ada8eae61a36517cf369f5bbe4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.17.6 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_balloon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa05a044c5c2e147d726ac2fae1a97e0775eac11",
              "status": "affected",
              "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
              "versionType": "git"
            },
            {
              "lessThan": "4ba5a8a7faa647ada8eae61a36517cf369f5bbe4",
              "status": "affected",
              "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_balloon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmw_balloon: indicate success when effectively deflating during migration\n\nWhen migrating a balloon page, we first deflate the old page to then\ninflate the new page.\n\nHowever, if inflating the new page succeeded, we effectively deflated the\nold page, reducing the balloon size.\n\nIn that case, the migration actually worked: similar to migrating+\nimmediately deflating the new page.  The old page will be freed back to\nthe buddy.\n\nRight now, the core will leave the page be marked as isolated (as we\nreturned an error).  When later trying to putback that page, we will run\ninto the WARN_ON_ONCE() in balloon_page_putback().\n\nThat handling was changed in commit 3544c4faccb8 (\"mm/balloon_compaction:\nstop using __ClearPageMovable()\"); before that change, we would have\ntolerated that way of handling it.\n\nTo fix it, let\u0027s just return 0 in that case, making the core effectively\njust clear the \"isolated\" flag + freeing it back to the buddy as if the\nmigration succeeded.  Note that the new page will also get freed when the\ncore puts the last reference.\n\nNote that this also makes it all be more consistent: we will no longer\nunisolate the page in the balloon driver while keeping it marked as being\nisolated in migration core.\n\nThis was found by code inspection."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:49:41.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa05a044c5c2e147d726ac2fae1a97e0775eac11"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ba5a8a7faa647ada8eae61a36517cf369f5bbe4"
        }
      ],
      "title": "vmw_balloon: indicate success when effectively deflating during migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68248",
    "datePublished": "2025-12-16T14:32:15.430Z",
    "dateReserved": "2025-12-16T13:41:40.266Z",
    "dateUpdated": "2026-05-11T21:49:41.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68248",
      "date": "2026-10-17",
      "epss": "0.00172",
      "percentile": "0.06155"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/vmw_balloon.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "aa05a044c5c2e147d726ac2fae1a97e0775eac11",
                    "status": "affected",
                    "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ba5a8a7faa647ada8eae61a36517cf369f5bbe4",
                    "status": "affected",
                    "version": "3544c4faccb8f0867bc65f8007ee70bfb5054305",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/vmw_balloon.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmw_balloon: indicate success when effectively deflating during migration\n\nWhen migrating a balloon page, we first deflate the old page to then\ninflate the new page.\n\nHowever, if inflating the new page succeeded, we effectively deflated the\nold page, reducing the balloon size.\n\nIn that case, the migration actually worked: similar to migrating+\nimmediately deflating the new page.  The old page will be freed back to\nthe buddy.\n\nRight now, the core will leave the page be marked as isolated (as we\nreturned an error).  When later trying to putback that page, we will run\ninto the WARN_ON_ONCE() in balloon_page_putback().\n\nThat handling was changed in commit 3544c4faccb8 (\"mm/balloon_compaction:\nstop using __ClearPageMovable()\"); before that change, we would have\ntolerated that way of handling it.\n\nTo fix it, let\u0027s just return 0 in that case, making the core effectively\njust clear the \"isolated\" flag + freeing it back to the buddy as if the\nmigration succeeded.  Note that the new page will also get freed when the\ncore puts the last reference.\n\nNote that this also makes it all be more consistent: we will no longer\nunisolate the page in the balloon driver while keeping it marked as being\nisolated in migration core.\n\nThis was found by code inspection."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvmw_balloon: indicar \u00e9xito al desinflar efectivamente durante la migraci\u00f3n\n\nAl migrar una p\u00e1gina balloon, primero desinflamos la p\u00e1gina antigua para luego inflar la nueva p\u00e1gina.\n\nSin embargo, si la inflaci\u00f3n de la nueva p\u00e1gina tuvo \u00e9xito, desinflamos efectivamente la p\u00e1gina antigua, reduciendo el tama\u00f1o del balloon.\n\nEn ese caso, la migraci\u00f3n realmente funcion\u00f3: similar a migrar + desinflar inmediatamente la nueva p\u00e1gina. La p\u00e1gina antigua ser\u00e1 liberada de vuelta al buddy.\n\nAhora mismo, el n\u00facleo dejar\u00e1 la p\u00e1gina marcada como aislada (ya que devolvimos un error). Al intentar luego devolver esa p\u00e1gina, nos encontraremos con el WARN_ON_ONCE() en balloon_page_putback().\n\nEse manejo fue cambiado en el commit 3544c4faccb8 (\u0027mm/balloon_compaction: dejar de usar __ClearPageMovable()\u0027); antes de ese cambio, habr\u00edamos tolerado esa forma de manejarlo.\n\nPara solucionarlo, simplemente devolvamos 0 en ese caso, haciendo que el n\u00facleo efectivamente solo borre la bandera \u0027isolated\u0027 + liber\u00e1ndola de vuelta al buddy como si la migraci\u00f3n hubiera tenido \u00e9xito. Tenga en cuenta que la nueva p\u00e1gina tambi\u00e9n ser\u00e1 liberada cuando el n\u00facleo ponga la \u00faltima referencia.\n\nTenga en cuenta que esto tambi\u00e9n hace que todo sea m\u00e1s consistente: ya no desaislaremos la p\u00e1gina en el controlador balloon mientras la mantenemos marcada como aislada en el n\u00facleo de migraci\u00f3n.\n\nEsto fue encontrado mediante inspecci\u00f3n de c\u00f3digo."
          }
        ],
        "id": "CVE-2025-68248",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {},
        "published": "2025-12-16T15:15:54.083",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ba5a8a7faa647ada8eae61a36517cf369f5bbe4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/aa05a044c5c2e147d726ac2fae1a97e0775eac11"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:19:33+00:00",
      "cve": "CVE-2025-68248",
      "id": "CVE-2025-68248",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vmw_balloon: indicate success when effectively deflating during migration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68248.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.