Riskcovery

CVE-2025-38686

userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry

State
Published
Severity
Not scored
Published
Sep 4, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry

When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swp_entry_t. Add the missing check and let split_huge_pmd() handle migration entries. While at it also remove unnecessary folio check.

[surenb@google.com: remove extra folio check, per David]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • adef440691bab824e39c1b17382322d195e1fab0 to before bb81c18dbd42650c844e160cafa7cbb20243a96aAffected
  • adef440691bab824e39c1b17382322d195e1fab0 to before 1202abad7a7ccd28c426d2844771a387b07629a4Affected
  • adef440691bab824e39c1b17382322d195e1fab0 to before 7f1101a0a181243ad587ececdffc4845f035549fAffected
  • adef440691bab824e39c1b17382322d195e1fab0 to before aba6faec0103ed8f169be8dce2ead41fcb689446Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.43 through 6.12.*Not affected
  • 6.15.11 through 6.15.*Not affected
  • 6.16.2 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.