CVE-2025-38207

What it actually does

The flaw allows a sequence of mremap operations on a VMA with a registered uprobe at file offset zero to cause the uprobe-installed anonymous PTE to be overwritten during vma_merge_new_range followed by move_page_tables, leaving an orphan PTE and corrupting the MM_ANONPAGES RSS counter.

Why it matters to the business

Kernel memory accounting becomes inconsistent on systems performing uprobe-based tracing or debugging combined with memory remapping, potentially leading to application instability, unexpected process termination, or kernel BUG conditions in production workloads that rely on dynamic memory mapping.

How an attack unfolds

An attacker registers an uprobe on a file at offset zero, then uses a crafted sequence of mmap followed by two mremap calls (one expanding the range and one moving it back with MREMAP_FIXED) to trigger vma merging; the subsequent uprobe_mmap in vma_complete installs a PTE that is immediately overwritten by set_pte_at during move_page_tables, orphaning the page table entry.

How to fix it

Upgrade the Linux kernel to a version containing commit 58b83b9a9a929611a2a2e7d88f45cb0d786b7ee0 or later; for affected packaged distributions such as azure-service-operator-fips apply version 2.13.0-r2 or newer.

How to confirm the fix worked

Confirm the running kernel contains commit 58b83b9a9a929611a2a2e7d88f45cb0d786b7ee0, reproduce the original Syzkaller reproducer steps and verify absence of the MM_ANONPAGES RSS counter BUG, and ensure uprobe PTEs remain correctly installed after repeated mremap operations on merged VMAs.

Typical attack path

1. Register uprobe on target file at offset zero
2. mmap the file with PROT_NONE at the same offset
3. Perform mremap to expand and relocate the VMA
4. Perform second mremap with MREMAP_FIXED to merge ranges
5. Trigger uprobe_mmap on merged VMA followed by move_page_tables to overwrite PTE

How to detect it

Search kernel logs and dmesg output across all hosts for "BUG: Bad rss-counter state" entries mentioning MM_ANONPAGES; inspect audit or tracing logs for sequences of uprobe registration immediately followed by mremap syscalls on the same file offset.

What your security team should do

• Prioritize kernel upgrades on all systems using uprobes or dynamic memory mapping workloads within the next maintenance window
• Monitor kernel logs for "Bad rss-counter state" messages on hosts performing mremap or uprobe activity
• Apply the fixed commit or packaged update listed for each distribution and reboot affected nodes