CVE-2025-40040 (GCVE-0-2025-40040)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-10-15 22:02
VLAI
Title
mm/ksm: fix flag-dropping behavior in ksm_madvise
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460 <snip other registers, drop unreliable trace> [ 44.617726] Call Trace: [ 44.617926] <TASK> [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP: 0033:0x7f365bb3f227 Kernel panics because it detects UFFD inconsistency during userfaultfd_release_all(). Specifically, a VMA which has a valid pointer to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags. The inconsistency is caused in ksm_madvise(): when user calls madvise() with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode, it accidentally clears all flags stored in the upper 32 bits of vma->vm_flags. Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and int are 32-bit wide. This setup causes the following mishap during the &= ~VM_MERGEABLE assignment. VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then promoted to unsigned long before the & operation. This promotion fills upper 32 bits with leading 0s, as we're doing unsigned conversion (and even for a signed conversion, this wouldn't help as the leading bit is 0). & operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears the upper 32-bits of its value. Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the BIT() macro. Note: other VM_* flags are not affected: This only happens to the VM_MERGEABLE flag, as the other VM_* flags are all constants of type int and after ~ operation, they end up with leading 1 and are thus converted to unsigned long with leading 1s. Note 2: After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is no longer a kernel BUG, but a WARNING at the same place: [ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067 but the root-cause (flag-drop) remains the same. [akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:56 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < 850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71 (git)
Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < 788e5385d0ff69cdba1cabccb9dab8d9647b9239 (git)
Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < b69f19244c2b6475c8a6eb72f0fb0d53509e48cd (git)
Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < 41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 (git)
Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < 92b82e232b8d8b116ac6e57aeae7a6033db92c60 (git)
Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < ac50c6e0a8f91a02b681af81abb2362fbb67cc18 (git)
Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < 76385629f45740b7888f8fcd83bde955b10f61fe (git)
Affected: 63c17fb8e5a46a16e10e82005748837fd11a2024 , < f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.4.302 , ≤ 5.4.* (semver)
Unaffected: 5.10.247 , ≤ 5.10.* (semver)
Unaffected: 5.15.197 , ≤ 5.15.* (semver)
Unaffected: 6.1.158 , ≤ 6.1.* (semver)
Unaffected: 6.6.114 , ≤ 6.6.* (semver)
Unaffected: 6.12.55 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40040",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:56:21.086400Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:36.606Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mm.h",
            "rust/bindings/bindings_helper.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            },
            {
              "lessThan": "788e5385d0ff69cdba1cabccb9dab8d9647b9239",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            },
            {
              "lessThan": "b69f19244c2b6475c8a6eb72f0fb0d53509e48cd",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            },
            {
              "lessThan": "41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            },
            {
              "lessThan": "92b82e232b8d8b116ac6e57aeae7a6033db92c60",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            },
            {
              "lessThan": "ac50c6e0a8f91a02b681af81abb2362fbb67cc18",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            },
            {
              "lessThan": "76385629f45740b7888f8fcd83bde955b10f61fe",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            },
            {
              "lessThan": "f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93",
              "status": "affected",
              "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mm.h",
            "rust/bindings/bindings_helper.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.302",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix flag-dropping behavior in ksm_madvise\n\nsyzkaller discovered the following crash: (kernel BUG)\n\n[   44.607039] ------------[ cut here ]------------\n[   44.607422] kernel BUG at mm/userfaultfd.c:2067!\n[   44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)\n[   44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n\u003csnip other registers, drop unreliable trace\u003e\n\n[   44.617726] Call Trace:\n[   44.617926]  \u003cTASK\u003e\n[   44.619284]  userfaultfd_release+0xef/0x1b0\n[   44.620976]  __fput+0x3f9/0xb60\n[   44.621240]  fput_close_sync+0x110/0x210\n[   44.622222]  __x64_sys_close+0x8f/0x120\n[   44.622530]  do_syscall_64+0x5b/0x2f0\n[   44.622840]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   44.623244] RIP: 0033:0x7f365bb3f227\n\nKernel panics because it detects UFFD inconsistency during\nuserfaultfd_release_all().  Specifically, a VMA which has a valid pointer\nto vma-\u003evm_userfaultfd_ctx, but no UFFD flags in vma-\u003evm_flags.\n\nThe inconsistency is caused in ksm_madvise(): when user calls madvise()\nwith MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,\nit accidentally clears all flags stored in the upper 32 bits of\nvma-\u003evm_flags.\n\nAssuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and\nint are 32-bit wide.  This setup causes the following mishap during the \u0026=\n~VM_MERGEABLE assignment.\n\nVM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000\u00270000. \nAfter ~ is applied, it becomes 0x7fff\u0027ffff unsigned int, which is then\npromoted to unsigned long before the \u0026 operation.  This promotion fills\nupper 32 bits with leading 0s, as we\u0027re doing unsigned conversion (and\neven for a signed conversion, this wouldn\u0027t help as the leading bit is 0).\n\u0026 operation thus ends up AND-ing vm_flags with 0x0000\u00270000\u00277fff\u0027ffff\ninstead of intended 0xffff\u0027ffff\u00277fff\u0027ffff and hence accidentally clears\nthe upper 32-bits of its value.\n\nFix it by changing `VM_MERGEABLE` constant to unsigned long, using the\nBIT() macro.\n\nNote: other VM_* flags are not affected: This only happens to the\nVM_MERGEABLE flag, as the other VM_* flags are all constants of type int\nand after ~ operation, they end up with leading 1 and are thus converted\nto unsigned long with leading 1s.\n\nNote 2:\nAfter commit 31defc3b01d9 (\"userfaultfd: remove (VM_)BUG_ON()s\"), this is\nno longer a kernel BUG, but a WARNING at the same place:\n\n[   45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067\n\nbut the root-cause (flag-drop) remains the same.\n\n[akpm@linux-foundation.org: rust bindgen wasn\u0027t able to handle BIT(), from Miguel]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached purely through the madvise(2) syscall (MADV_MERGEABLE/MADV_UNMERGEABLE) on the caller\u0027s own address space, with no network or remote component. Local access to the system is required.\nAC:L - The flag drop is a deterministic C integer-promotion defect that triggers on every MADV_UNMERGEABLE call \u2014 no race, no memory-layout grooming, and no conditions outside the attacker\u0027s control. A short single-threaded reproducer (memfd + MAP_PRIVATE + MADV_MERGEABLE + UFFDIO_REGISTER(MINOR) + MADV_UNMERGEABLE + close) works 100% of the time.\nPR:L - Any unprivileged local user can do this: memfd_create() and MAP_PRIVATE need no capability, and userfaultfd(UFFD_USER_MODE_ONLY) is explicitly allowed to unprivileged callers regardless of vm.unprivileged_userfaultfd or CAP_SYS_PTRACE. The mseal/pkey/shadow-stack flag-drop variants need no special facility at all.\nUI:N - The attacking process performs the entire sequence itself via its own syscalls; no other user or administrator has to open a file, mount anything, or take any action.\nS:U - The corrupted state is the attacker\u0027s own VMA flags and the resulting crash or protection loss stays within the kernel and the process\u0027s own address space, without crossing into a hypervisor, IOMMU, or other security authority.\nC:H - Clearing VM_PKEY_BIT0..4 makes vma_pkey() return 0 and drops _PAGE_PKEY_* from the recomputed page protection, silently revoking MPK-based isolation so an untrusted in-process component can read memory it was walled off from; combined with the VM_SEALED drop (allowing mremap of regions the policy pinned) this yields disclosure of memory the kernel was supposed to keep protected.\nI:H - The wipe silently revokes kernel-enforced write protections: VM_SEALED loss is a full mseal(2) bypass (sealed code/GOT regions become mprotect-able and munmap-able), and VM_SHADOW_STACK loss lets userspace write its own CET shadow stack, defeating control-flow integrity and enabling ROP \u2014 memory the kernel guaranteed immutable becomes attacker-writable.\nA:H - Dropping VM_UFFD_MINOR while leaving vma-\u003evm_userfaultfd_ctx set creates the inconsistency that userfaultfd_release_all() asserts on, producing a kernel BUG()/invalid-opcode panic on close() (a WARNING at mm/userfaultfd.c:2067 after 31defc3b01d9, still fatal under panic_on_warn). Any local user can trigger this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:14.111Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71"
        },
        {
          "url": "https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239"
        },
        {
          "url": "https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693"
        },
        {
          "url": "https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18"
        },
        {
          "url": "https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93"
        }
      ],
      "title": "mm/ksm: fix flag-dropping behavior in ksm_madvise",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40040",
    "datePublished": "2025-10-28T11:48:20.395Z",
    "dateReserved": "2025-04-16T07:20:57.154Z",
    "dateUpdated": "2026-10-15T22:02:36.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40040",
      "date": "2026-10-29",
      "epss": "0.00376",
      "percentile": "0.31534"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-03T14:57:39.000Z",
      "cve": "CVE-2025-40040",
      "id": "msrc_CVE-2025-40040",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mm/ksm: fix flag-dropping behavior in ksm_madvise",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40040.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/mm.h",
                  "rust/bindings/bindings_helper.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "788e5385d0ff69cdba1cabccb9dab8d9647b9239",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b69f19244c2b6475c8a6eb72f0fb0d53509e48cd",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92b82e232b8d8b116ac6e57aeae7a6033db92c60",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ac50c6e0a8f91a02b681af81abb2362fbb67cc18",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "76385629f45740b7888f8fcd83bde955b10f61fe",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93",
                    "status": "affected",
                    "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/mm.h",
                  "rust/bindings/bindings_helper.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.302",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.247",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.197",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92D7EAC7-85AD-4A59-982E-28696A9CB495",
                    "versionEndExcluding": "5.4.302",
                    "versionStartIncluding": "4.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE19816A-13B7-4862-B963-A4DF36CA766A",
                    "versionEndExcluding": "5.10.247",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "06E8A34D-C8D8-461A-B8F8-0E420CC5E116",
                    "versionEndExcluding": "5.15.197",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "77B0D8DC-487F-497A-8C89-E7C8F6427586",
                    "versionEndExcluding": "6.1.158",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4EB737C8-40A2-4187-8371-FFB0D2615B8B",
                    "versionEndExcluding": "6.6.114",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "516AE9B7-F899-4BF2-A81C-BAB0A37671FA",
                    "versionEndExcluding": "6.12.55",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F55A160F-1578-4C10-ABCB-F90B7E146ED8",
                    "versionEndExcluding": "6.17.3",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix flag-dropping behavior in ksm_madvise\n\nsyzkaller discovered the following crash: (kernel BUG)\n\n[   44.607039] ------------[ cut here ]------------\n[   44.607422] kernel BUG at mm/userfaultfd.c:2067!\n[   44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)\n[   44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n\u003csnip other registers, drop unreliable trace\u003e\n\n[   44.617726] Call Trace:\n[   44.617926]  \u003cTASK\u003e\n[   44.619284]  userfaultfd_release+0xef/0x1b0\n[   44.620976]  __fput+0x3f9/0xb60\n[   44.621240]  fput_close_sync+0x110/0x210\n[   44.622222]  __x64_sys_close+0x8f/0x120\n[   44.622530]  do_syscall_64+0x5b/0x2f0\n[   44.622840]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   44.623244] RIP: 0033:0x7f365bb3f227\n\nKernel panics because it detects UFFD inconsistency during\nuserfaultfd_release_all().  Specifically, a VMA which has a valid pointer\nto vma-\u003evm_userfaultfd_ctx, but no UFFD flags in vma-\u003evm_flags.\n\nThe inconsistency is caused in ksm_madvise(): when user calls madvise()\nwith MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,\nit accidentally clears all flags stored in the upper 32 bits of\nvma-\u003evm_flags.\n\nAssuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and\nint are 32-bit wide.  This setup causes the following mishap during the \u0026=\n~VM_MERGEABLE assignment.\n\nVM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000\u00270000. \nAfter ~ is applied, it becomes 0x7fff\u0027ffff unsigned int, which is then\npromoted to unsigned long before the \u0026 operation.  This promotion fills\nupper 32 bits with leading 0s, as we\u0027re doing unsigned conversion (and\neven for a signed conversion, this wouldn\u0027t help as the leading bit is 0).\n\u0026 operation thus ends up AND-ing vm_flags with 0x0000\u00270000\u00277fff\u0027ffff\ninstead of intended 0xffff\u0027ffff\u00277fff\u0027ffff and hence accidentally clears\nthe upper 32-bits of its value.\n\nFix it by changing `VM_MERGEABLE` constant to unsigned long, using the\nBIT() macro.\n\nNote: other VM_* flags are not affected: This only happens to the\nVM_MERGEABLE flag, as the other VM_* flags are all constants of type int\nand after ~ operation, they end up with leading 1 and are thus converted\nto unsigned long with leading 1s.\n\nNote 2:\nAfter commit 31defc3b01d9 (\"userfaultfd: remove (VM_)BUG_ON()s\"), this is\nno longer a kernel BUG, but a WARNING at the same place:\n\n[   45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067\n\nbut the root-cause (flag-drop) remains the same.\n\n[akpm@linux-foundation.org: rust bindgen wasn\u0027t able to handle BIT(), from Miguel]"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/ksm: corrige el comportamiento de eliminaci\u00f3n de banderas en ksm_madvise\n\nsyzkaller descubri\u00f3 el siguiente fallo: (BUG del kernel)\n\n[   44.607039] ------------[ cortar aqu\u00ed ]------------\n[   44.607422] BUG del kernel en mm/userfaultfd.c:2067!\n[   44.608148] Oops: c\u00f3digo de operaci\u00f3n inv\u00e1lido: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproductor No contaminado 6.16.0-rc6 #1 PREEMPT(none)\n[   44.609635] Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n\u003cse omiten otros registros, se descarta el rastreo no fiable\u003e\n\n[   44.617726] Rastreo de Llamadas:\n[   44.617926]  \u003cTAREA\u003e\n[   44.619284]  userfaultfd_release+0xef/0x1b0\n[   44.620976]  __fput+0x3f9/0xb60\n[   44.621240]  fput_close_sync+0x110/0x210\n[   44.622222]  __x64_sys_close+0x8f/0x120\n[   44.622530]  do_syscall_64+0x5b/0x2f0\n[   44.622840]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   44.623244] RIP: 0033:0x7f365bb3f227\n\nEl kernel entra en p\u00e1nico porque detecta una inconsistencia de UFFD durante userfaultfd_release_all(). Espec\u00edficamente, un VMA que tiene un puntero v\u00e1lido a vma-\u003evm_userfaultfd_ctx, pero sin banderas UFFD en vma-\u003evm_flags.\n\nLa inconsistencia es causada en ksm_madvise(): cuando el usuario llama a madvise() con MADV_UNMEARGEABLE en un VMA que est\u00e1 registrado para UFFD en modo MINOR, borra accidentalmente todas las banderas almacenadas en los 32 bits superiores de vma-\u003evm_flags.\n\nAsumiendo una compilaci\u00f3n del kernel x86_64, unsigned long es de 64 bits y unsigned int e int son de 32 bits de ancho. Esta configuraci\u00f3n causa el siguiente percance durante la asignaci\u00f3n \u0026= ~VM_MERGEABLE.\n\nVM_MERGEABLE es una constante de 32 bits de tipo unsigned int, 0x8000\u00270000. Despu\u00e9s de aplicar ~, se convierte en 0x7fff\u0027ffff unsigned int, que luego se promociona a unsigned long antes de la operaci\u00f3n \u0026. Esta promoci\u00f3n llena los 32 bits superiores con ceros iniciales, ya que estamos haciendo una conversi\u00f3n sin signo (e incluso para una conversi\u00f3n con signo, esto no ayudar\u00eda ya que el bit inicial es 0). La operaci\u00f3n \u0026 termina haciendo un AND de vm_flags con 0x0000\u00270000\u00277fff\u0027ffff en lugar del 0xffff\u0027ffff\u00277fff\u0027ffff previsto y, por lo tanto, borra accidentalmente los 32 bits superiores de su valor.\n\nCorr\u00edgelo cambiando la constante VM_MERGEABLE a unsigned long, usando la macro BIT().\n\nNota: otras banderas VM_* no se ven afectadas: Esto solo le ocurre a la bandera VM_MERGEABLE, ya que las otras banderas VM_* son todas constantes de tipo int y despu\u00e9s de la operaci\u00f3n ~, terminan con un 1 inicial y por lo tanto se convierten a unsigned long con 1s iniciales.\n\nNota 2:\nDespu\u00e9s del commit 31defc3b01d9 (\u0027userfaultfd: remove (VM_)BUG_ON()s\u0027), esto ya no es un BUG del kernel, sino una ADVERTENCIA en el mismo lugar:\n\n[   45.595973] ADVERTENCIA: CPU: 1 PID: 2474 en mm/userfaultfd.c:2067\n\npero la causa ra\u00edz (eliminaci\u00f3n de bandera) sigue siendo la misma.\n\n[akpm@linux-foundation.org: rust bindgen no pudo manejar BIT(), de Miguel]"
          }
        ],
        "id": "CVE-2025-40040",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-40040",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:56:21.086400Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-28T12:15:37.967",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:52:38+00:00",
      "cve": "CVE-2025-40040",
      "id": "CVE-2025-40040",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/ksm: fix flag-dropping behavior in ksm_madvise",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40040.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-40040",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T21:56:21.086400Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T21:56:21.660Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "include/linux/mm.h",
                "rust/bindings/bindings_helper.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                },
                {
                  "lessThan": "788e5385d0ff69cdba1cabccb9dab8d9647b9239",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                },
                {
                  "lessThan": "b69f19244c2b6475c8a6eb72f0fb0d53509e48cd",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                },
                {
                  "lessThan": "41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                },
                {
                  "lessThan": "92b82e232b8d8b116ac6e57aeae7a6033db92c60",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                },
                {
                  "lessThan": "ac50c6e0a8f91a02b681af81abb2362fbb67cc18",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                },
                {
                  "lessThan": "76385629f45740b7888f8fcd83bde955b10f61fe",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                },
                {
                  "lessThan": "f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93",
                  "status": "affected",
                  "version": "63c17fb8e5a46a16e10e82005748837fd11a2024",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "include/linux/mm.h",
                "rust/bindings/bindings_helper.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.6"
                },
                {
                  "lessThan": "4.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.302",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.247",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.197",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.158",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.114",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.55",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.17.*",
                  "status": "unaffected",
                  "version": "6.17.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.18",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.302",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.247",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.197",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.158",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.114",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.55",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17.3",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18",
                      "versionStartIncluding": "4.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix flag-dropping behavior in ksm_madvise\n\nsyzkaller discovered the following crash: (kernel BUG)\n\n[   44.607039] ------------[ cut here ]------------\n[   44.607422] kernel BUG at mm/userfaultfd.c:2067!\n[   44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)\n[   44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n\u003csnip other registers, drop unreliable trace\u003e\n\n[   44.617726] Call Trace:\n[   44.617926]  \u003cTASK\u003e\n[   44.619284]  userfaultfd_release+0xef/0x1b0\n[   44.620976]  __fput+0x3f9/0xb60\n[   44.621240]  fput_close_sync+0x110/0x210\n[   44.622222]  __x64_sys_close+0x8f/0x120\n[   44.622530]  do_syscall_64+0x5b/0x2f0\n[   44.622840]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   44.623244] RIP: 0033:0x7f365bb3f227\n\nKernel panics because it detects UFFD inconsistency during\nuserfaultfd_release_all().  Specifically, a VMA which has a valid pointer\nto vma-\u003evm_userfaultfd_ctx, but no UFFD flags in vma-\u003evm_flags.\n\nThe inconsistency is caused in ksm_madvise(): when user calls madvise()\nwith MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,\nit accidentally clears all flags stored in the upper 32 bits of\nvma-\u003evm_flags.\n\nAssuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and\nint are 32-bit wide.  This setup causes the following mishap during the \u0026=\n~VM_MERGEABLE assignment.\n\nVM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000\u00270000. \nAfter ~ is applied, it becomes 0x7fff\u0027ffff unsigned int, which is then\npromoted to unsigned long before the \u0026 operation.  This promotion fills\nupper 32 bits with leading 0s, as we\u0027re doing unsigned conversion (and\neven for a signed conversion, this wouldn\u0027t help as the leading bit is 0).\n\u0026 operation thus ends up AND-ing vm_flags with 0x0000\u00270000\u00277fff\u0027ffff\ninstead of intended 0xffff\u0027ffff\u00277fff\u0027ffff and hence accidentally clears\nthe upper 32-bits of its value.\n\nFix it by changing `VM_MERGEABLE` constant to unsigned long, using the\nBIT() macro.\n\nNote: other VM_* flags are not affected: This only happens to the\nVM_MERGEABLE flag, as the other VM_* flags are all constants of type int\nand after ~ operation, they end up with leading 1 and are thus converted\nto unsigned long with leading 1s.\n\nNote 2:\nAfter commit 31defc3b01d9 (\"userfaultfd: remove (VM_)BUG_ON()s\"), this is\nno longer a kernel BUG, but a WARNING at the same place:\n\n[   45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067\n\nbut the root-cause (flag-drop) remains the same.\n\n[akpm@linux-foundation.org: rust bindgen wasn\u0027t able to handle BIT(), from Miguel]"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is reached purely through the madvise(2) syscall (MADV_MERGEABLE/MADV_UNMERGEABLE) on the caller\u0027s own address space, with no network or remote component. Local access to the system is required.\nAC:L - The flag drop is a deterministic C integer-promotion defect that triggers on every MADV_UNMERGEABLE call \u2014 no race, no memory-layout grooming, and no conditions outside the attacker\u0027s control. A short single-threaded reproducer (memfd + MAP_PRIVATE + MADV_MERGEABLE + UFFDIO_REGISTER(MINOR) + MADV_UNMERGEABLE + close) works 100% of the time.\nPR:L - Any unprivileged local user can do this: memfd_create() and MAP_PRIVATE need no capability, and userfaultfd(UFFD_USER_MODE_ONLY) is explicitly allowed to unprivileged callers regardless of vm.unprivileged_userfaultfd or CAP_SYS_PTRACE. The mseal/pkey/shadow-stack flag-drop variants need no special facility at all.\nUI:N - The attacking process performs the entire sequence itself via its own syscalls; no other user or administrator has to open a file, mount anything, or take any action.\nS:U - The corrupted state is the attacker\u0027s own VMA flags and the resulting crash or protection loss stays within the kernel and the process\u0027s own address space, without crossing into a hypervisor, IOMMU, or other security authority.\nC:H - Clearing VM_PKEY_BIT0..4 makes vma_pkey() return 0 and drops _PAGE_PKEY_* from the recomputed page protection, silently revoking MPK-based isolation so an untrusted in-process component can read memory it was walled off from; combined with the VM_SEALED drop (allowing mremap of regions the policy pinned) this yields disclosure of memory the kernel was supposed to keep protected.\nI:H - The wipe silently revokes kernel-enforced write protections: VM_SEALED loss is a full mseal(2) bypass (sealed code/GOT regions become mprotect-able and munmap-able), and VM_SHADOW_STACK loss lets userspace write its own CET shadow stack, defeating control-flow integrity and enabling ROP \u2014 memory the kernel guaranteed immutable becomes attacker-writable.\nA:H - Dropping VM_UFFD_MINOR while leaving vma-\u003evm_userfaultfd_ctx set creates the inconsistency that userfaultfd_release_all() asserts on, producing a kernel BUG()/invalid-opcode panic on close() (a WARNING at mm/userfaultfd.c:2067 after 31defc3b01d9, still fatal under panic_on_warn). Any local user can trigger this at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:07:14.111Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71"
            },
            {
              "url": "https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239"
            },
            {
              "url": "https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd"
            },
            {
              "url": "https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693"
            },
            {
              "url": "https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60"
            },
            {
              "url": "https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18"
            },
            {
              "url": "https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe"
            },
            {
              "url": "https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93"
            }
          ],
          "title": "mm/ksm: fix flag-dropping behavior in ksm_madvise",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-40040",
        "datePublished": "2025-10-28T11:48:20.395Z",
        "dateReserved": "2025-04-16T07:20:57.154Z",
        "dateUpdated": "2026-10-15T22:02:36.606Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.