CVE-2025-71155 (GCVE-0-2025-71155)

Vulnerability from cvelistv5 – Published: 2026-01-23 14:25 – Updated: 2026-08-05 12:12
VLAI
Title
KVM: s390: Fix gmap_helper_zap_one_page() again
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gmap_helper_zap_one_page() again A few checks were missing in gmap_helper_zap_one_page(), which can lead to memory corruption in the guest under specific circumstances. Add the missing checks.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5deafa27d9ae040b75d392f60b12e300b42b4792 , < 2af2abbcbf8573100288e8f8aea2dab8a2a0ceb7 (git)
Affected: 5deafa27d9ae040b75d392f60b12e300b42b4792 , < 2f393c228cc519ddf19b8c6c05bf15723241aa96 (git)
Affected: 919efcadb63fc3d3a82c3de7194140e0b28903dc (git)
Affected: 6.17.4 , < 6.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.4 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/gmap_helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2af2abbcbf8573100288e8f8aea2dab8a2a0ceb7",
              "status": "affected",
              "version": "5deafa27d9ae040b75d392f60b12e300b42b4792",
              "versionType": "git"
            },
            {
              "lessThan": "2f393c228cc519ddf19b8c6c05bf15723241aa96",
              "status": "affected",
              "version": "5deafa27d9ae040b75d392f60b12e300b42b4792",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "919efcadb63fc3d3a82c3de7194140e0b28903dc",
              "versionType": "git"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/gmap_helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix gmap_helper_zap_one_page() again\n\nA few checks were missing in gmap_helper_zap_one_page(), which can lead\nto memory corruption in the guest under specific circumstances.\n\nAdd the missing checks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An unprivileged process inside an s390 KVM guest can drive the vulnerable path through ordinary page allocation and freeing, which invokes ESSA and reaches handle_essa(), __gmap_zap(), and gmap_helper_zap_one_page().\nAC:L - The attacker can use concurrent memory churn across vCPUs to control the relevant page-state transitions and can induce host backing-memory pressure by touching guest RAM, making repeated race attempts practical.\nPR:L - Although ESSA is privileged, unprivileged guest activity invokes it indirectly through arch_alloc_page() and arch_free_page() without requiring guest administrative capabilities.\nUI:N - Exploitation requires no action by another user once the attacker runs the memory-churning workload.\nS:U - The corruption affects memory within the same guest security authority and does not provide a demonstrated guest-to-host or cross-VM escape.\nC:H - Incorrectly discarding a stable swapped guest page can corrupt attacker-groomed guest kernel memory; successful exploitation could yield guest-kernel execution and unrestricted access to guest secrets.\nI:H - The flaw can replace preserved guest-page contents with a newly faulted page, enabling whole-page corruption of sensitive data or control structures and potentially guest-kernel code execution.\nA:H - Corruption of arbitrary guest data, page tables, or kernel control structures can panic, hang, or otherwise render the guest unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:23.055Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2af2abbcbf8573100288e8f8aea2dab8a2a0ceb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f393c228cc519ddf19b8c6c05bf15723241aa96"
        }
      ],
      "title": "KVM: s390: Fix gmap_helper_zap_one_page() again",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71155",
    "datePublished": "2026-01-23T14:25:54.663Z",
    "dateReserved": "2026-01-13T15:30:19.663Z",
    "dateUpdated": "2026-08-05T12:12:23.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71155",
      "date": "2026-09-20",
      "epss": "0.00131",
      "percentile": "0.03106"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/s390/mm/gmap_helpers.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2af2abbcbf8573100288e8f8aea2dab8a2a0ceb7",
                    "status": "affected",
                    "version": "5deafa27d9ae040b75d392f60b12e300b42b4792",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2f393c228cc519ddf19b8c6c05bf15723241aa96",
                    "status": "affected",
                    "version": "5deafa27d9ae040b75d392f60b12e300b42b4792",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "919efcadb63fc3d3a82c3de7194140e0b28903dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "affected",
                    "version": "6.17.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/s390/mm/gmap_helpers.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "03CF48C0-2F25-4797-9371-AD6932300161",
                    "versionEndExcluding": "6.18",
                    "versionStartIncluding": "6.17.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D37AAB65-4B09-43FD-A968-0F91D794D3BA",
                    "versionEndExcluding": "6.18.4",
                    "versionStartIncluding": "6.18",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix gmap_helper_zap_one_page() again\n\nA few checks were missing in gmap_helper_zap_one_page(), which can lead\nto memory corruption in the guest under specific circumstances.\n\nAdd the missing checks."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: s390: Corregir gmap_helper_zap_one_page() de nuevo\n\nFaltaban algunas comprobaciones en gmap_helper_zap_one_page(), lo que puede llevar a corrupci\u00f3n de memoria en el invitado bajo circunstancias espec\u00edficas.\n\nA\u00f1adir las comprobaciones faltantes."
          }
        ],
        "id": "CVE-2025-71155",
        "lastModified": "2026-07-30T06:24:54.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-01-23T15:16:06.447",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2af2abbcbf8573100288e8f8aea2dab8a2a0ceb7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2f393c228cc519ddf19b8c6c05bf15723241aa96"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T11:44:36+00:00",
      "cve": "CVE-2025-71155",
      "id": "CVE-2025-71155",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel KVM: Memory corruption in s390 gmap_helper_zap_one_page()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71155.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.