Vulnerability-Lookup

FKIE_CVE-2025-68211

Vulnerability from fkie_nvd - Published: 2025-12-16 14:15 - Updated: 2026-10-14 13:10

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1]. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page: #include <unistd.h> #include <stdio.h> #include <sys/mman.h> /* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; } $ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run Without this patch ksmd uses 100% of the cpu for a long time (more then 1 hour in my test machine) scanning all the 32 TiB virtual address space that contain only one mapped page. This makes ksmd essentially deadlocked not able to deduplicate anything of value. With this patch ksmd walks only the one mapped page and skips the rest of the 32 TiB virtual address space, making the scan fast using little cpu.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/10644e8839544dd5699c03c8fb1aeeefc41602fd	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/220cb3e425e17587f560335924cba9f16a842c64	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/67137b715b7db28d82e4ed07a7092c2fa6ba7adb	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/74f78421c925b6d17695566f0c5941de57fd44b3	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9c2f8a9b68024e5ebb4813665845ec0a95f2eac3	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f5548c318d6520d4fa3c5ed6003eeb710763cbc5	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f62973e0767e4fcd6799087787fca08ca2a85b8c	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.18
linux	linux_kernel	6.18
linux	linux_kernel	6.18
linux	linux_kernel	6.18
linux	linux_kernel	6.18

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/ksm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "220cb3e425e17587f560335924cba9f16a842c64",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "10644e8839544dd5699c03c8fb1aeeefc41602fd",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "67137b715b7db28d82e4ed07a7092c2fa6ba7adb",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "9c2f8a9b68024e5ebb4813665845ec0a95f2eac3",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "74f78421c925b6d17695566f0c5941de57fd44b3",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "f62973e0767e4fcd6799087787fca08ca2a85b8c",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "f5548c318d6520d4fa3c5ed6003eeb710763cbc5",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/ksm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B007F439-6EEB-48A9-8FE9-4911DB2F7763",
              "versionEndExcluding": "5.10.249",
              "versionStartIncluding": "2.6.32",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A247FBA6-BEB9-484F-B892-DD5517949CCD",
              "versionEndExcluding": "5.15.199",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E135B7E2-61FC-4DC1-8570-ABD67894FFDE",
              "versionEndExcluding": "6.1.161",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB7A164B-7422-4A1C-82FB-5FCAEE53C06C",
              "versionEndExcluding": "6.6.121",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F31B9755-3C98-42CB-8006-0DF32DCD5AF5",
              "versionEndExcluding": "6.12.59",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02A34EC6-429C-4CA9-BF4C-09313652458E",
              "versionEndExcluding": "6.17.9",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "DD01661D-DFC8-4B6D-80E7-46D203CC4565",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "A8A65C5A-918F-4E0B-8E98-08A29FFBA58A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages.  This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range().  The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups.  This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include \u003cunistd.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003csys/mman.h\u003e\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n        char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n        if (area == MAP_FAILED) {\n                perror(\"mmap() failed\\n\");\n                return -1;\n        }\n\n        /* Populate a single page such that we get an anon_vma. */\n        *area = 0;\n\n        /* Enable KSM. */\n        madvise(area, size, MADV_MERGEABLE);\n        pause();\n        return 0;\n}\n\n$ ./ksm-sparse  \u0026\n$ echo 1 \u003e /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page.  This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value.  With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksm: usar la funci\u00f3n de recorrido de rango para saltar sobre los huecos en scan_get_next_rmap_item\n\nActualmente, scan_get_next_rmap_item() recorre cada direcci\u00f3n de p\u00e1gina en un VMA para localizar p\u00e1ginas fusionables. Esto se vuelve altamente ineficiente al escanear grandes \u00e1reas de memoria virtual que contienen en su mayor\u00eda regiones no mapeadas, lo que hace que ksmd use una gran cantidad de CPU sin desduplicar muchas p\u00e1ginas.\n\nEste parche reemplaza la b\u00fasqueda por direcci\u00f3n con un recorrido de rango usando walk_page_range(). El recorredor de rangos permite a KSM saltar sobre huecos no mapeados completos en un VMA, evitando b\u00fasquedas innecesarias. Este problema fue discutido previamente en [1].\n\nConsidere el siguiente programa de prueba que crea un mapeo de 32 TiB en el espacio de direcciones virtual pero solo rellena una \u00fanica p\u00e1gina:\n\n#include \u003cunistd.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003csys/mman.h\u003e\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n        char area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n        if (area == MAP_FAILED) {\n                perror(\u201cmmap() failed\\n\u201d);\n                return -1;\n        }\n\n        /* Populate a single page such that we get an anon_vma. */\n        area = 0;\n\n        /* Enable KSM. */\n        madvise(area, size, MADV_MERGEABLE);\n        pause();\n        return 0;\n}\n\n$ ./ksm-sparse  \u0026\n$ echo 1 \u003e /sys/kernel/mm/ksm/run \n\nSin este parche, ksmd usa el 100% de la CPU durante mucho tiempo (m\u00e1s de 1 hora en mi m\u00e1quina de prueba) escaneando todo el espacio de direcciones virtual de 32 TiB que contiene solo una p\u00e1gina mapeada. Esto hace que ksmd quede esencialmente bloqueado sin poder desduplicar nada de valor. Con este parche, ksmd recorre solo la p\u00e1gina mapeada y salta el resto del espacio de direcciones virtual de 32 TiB, haciendo que el escaneo sea r\u00e1pido usando poca CPU."
    }
  ],
  "id": "CVE-2025-68211",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68211",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-10T20:42:07.997005Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-16T14:15:54.023",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/10644e8839544dd5699c03c8fb1aeeefc41602fd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/220cb3e425e17587f560335924cba9f16a842c64"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/67137b715b7db28d82e4ed07a7092c2fa6ba7adb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/74f78421c925b6d17695566f0c5941de57fd44b3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9c2f8a9b68024e5ebb4813665845ec0a95f2eac3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f5548c318d6520d4fa3c5ed6003eeb710763cbc5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f62973e0767e4fcd6799087787fca08ca2a85b8c"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-68211 (GCVE-0-2025-68211)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:48 – Updated: 2026-06-11 18:44

Title

ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:42 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6637 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/220cb3e425e17587f…
https://git.kernel.org/stable/c/10644e8839544dd56…
https://git.kernel.org/stable/c/67137b715b7db28d8…
https://git.kernel.org/stable/c/9c2f8a9b68024e5eb…
https://git.kernel.org/stable/c/74f78421c925b6d17…
https://git.kernel.org/stable/c/f62973e0767e4fcd6…
https://git.kernel.org/stable/c/f5548c318d6520d4f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 31dbd01f314364b70c2e026a5793a29a4da8a9dc , < 220cb3e425e17587f560335924cba9f16a842c64 (git) Affected: 31dbd01f314364b70c2e026a5793a29a4da8a9dc , < 10644e8839544dd5699c03c8fb1aeeefc41602fd (git) Affected: 31dbd01f314364b70c2e026a5793a29a4da8a9dc , < 67137b715b7db28d82e4ed07a7092c2fa6ba7adb (git) Affected: 31dbd01f314364b70c2e026a5793a29a4da8a9dc , < 9c2f8a9b68024e5ebb4813665845ec0a95f2eac3 (git) Affected: 31dbd01f314364b70c2e026a5793a29a4da8a9dc , < 74f78421c925b6d17695566f0c5941de57fd44b3 (git) Affected: 31dbd01f314364b70c2e026a5793a29a4da8a9dc , < f62973e0767e4fcd6799087787fca08ca2a85b8c (git) Affected: 31dbd01f314364b70c2e026a5793a29a4da8a9dc , < f5548c318d6520d4fa3c5ed6003eeb710763cbc5 (git)
Linux	Linux	Affected: 2.6.32 Unaffected: 0 , < 2.6.32 (semver) Unaffected: 5.10.249 , ≤ 5.10.* (semver) Unaffected: 5.15.199 , ≤ 5.15.* (semver) Unaffected: 6.1.161 , ≤ 6.1.* (semver) Unaffected: 6.6.121 , ≤ 6.6.* (semver) Unaffected: 6.12.59 , ≤ 6.12.* (semver) Unaffected: 6.17.9 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68211",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:07.997005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:19.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/ksm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "220cb3e425e17587f560335924cba9f16a842c64",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "10644e8839544dd5699c03c8fb1aeeefc41602fd",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "67137b715b7db28d82e4ed07a7092c2fa6ba7adb",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "9c2f8a9b68024e5ebb4813665845ec0a95f2eac3",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "74f78421c925b6d17695566f0c5941de57fd44b3",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "f62973e0767e4fcd6799087787fca08ca2a85b8c",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            },
            {
              "lessThan": "f5548c318d6520d4fa3c5ed6003eeb710763cbc5",
              "status": "affected",
              "version": "31dbd01f314364b70c2e026a5793a29a4da8a9dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/ksm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.161",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.121",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages.  This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range().  The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups.  This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include \u003cunistd.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003csys/mman.h\u003e\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n        char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n        if (area == MAP_FAILED) {\n                perror(\"mmap() failed\\n\");\n                return -1;\n        }\n\n        /* Populate a single page such that we get an anon_vma. */\n        *area = 0;\n\n        /* Enable KSM. */\n        madvise(area, size, MADV_MERGEABLE);\n        pause();\n        return 0;\n}\n\n$ ./ksm-sparse  \u0026\n$ echo 1 \u003e /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page.  This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value.  With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:48:52.139Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/220cb3e425e17587f560335924cba9f16a842c64"
        },
        {
          "url": "https://git.kernel.org/stable/c/10644e8839544dd5699c03c8fb1aeeefc41602fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/67137b715b7db28d82e4ed07a7092c2fa6ba7adb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c2f8a9b68024e5ebb4813665845ec0a95f2eac3"
        },
        {
          "url": "https://git.kernel.org/stable/c/74f78421c925b6d17695566f0c5941de57fd44b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f62973e0767e4fcd6799087787fca08ca2a85b8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5548c318d6520d4fa3c5ed6003eeb710763cbc5"
        }
      ],
      "title": "ksm: use range-walk function to jump over holes in scan_get_next_rmap_item",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68211",
    "datePublished": "2025-12-16T13:48:37.959Z",
    "dateReserved": "2025-12-16T13:41:40.256Z",
    "dateUpdated": "2026-06-11T18:44:19.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted