CVE-2025-22000

mm/huge_memory: drop beyond-EOF folios with the right number of refs

State
Published
Severity
5.5 Medium
Published
Apr 3, 2025
Updated
May 11, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: drop beyond-EOF folios with the right number of refs

When an after-split folio is large and needs to be dropped due to EOF, folio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all page cache refs. Otherwise, the folio will not be freed, causing memory leak.

This leak would happen on a filesystem with blocksize > page_size and a truncate is performed, where the blocksize makes folios split to >0 order ones, causing truncated folios not being freed.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • c010d47f107f609b9f4d6a103b6dfc53889049e9 to before 86368616a9ce51f6b41efa251b6e066893851d67Affected
  • c010d47f107f609b9f4d6a103b6dfc53889049e9 to before 92ad820a1f2d95d5a8d6c2bd3f391bbb068a5f9eAffected
  • c010d47f107f609b9f4d6a103b6dfc53889049e9 to before 14efb4793519d73fb2902bb0ece319b886e4b4b9Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.12.21 through 6.12.*Not affected
  • 6.13.9 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.