CVE-2025-38686

What it actually does

The flaw causes UFFDIO_MOVE to dereference a migration PMD entry as a valid folio instead of treating it as swp_entry_t, resulting in invalid memory access and kernel crash.

Why it matters to the business

Systems may experience unexpected crashes or instability during memory management operations involving userfaultfd, potentially disrupting workloads that rely on live migration or copy-on-write mechanisms.

How an attack unfolds

An attacker with the ability to trigger UFFDIO_MOVE on a process address space containing a migration PMD entry can cause the kernel to mishandle the entry, leading to a crash. No named threat actors are associated with this issue.

How to fix it

Apply the upstream fix present in commit bb81c18dbd42650c844e160cafa7cbb20243a96a or upgrade to a Linux kernel version containing this commit.

How to confirm the fix worked

Confirm the presence of commit bb81c18dbd42650c844e160cafa7cbb20243a96a in the kernel source tree and verify that UFFDIO_MOVE operations on migration PMD entries no longer cause crashes.

Typical attack path

1. Obtain capability to invoke UFFDIO_MOVE ioctl on a target process
2. Arrange for a PMD entry in the affected range to be a migration entry
3. Issue the UFFDIO_MOVE operation without the missing migration check
4. Kernel proceeds to obtain and access a folio from the swp_entry_t, triggering the crash

How to detect it

Review kernel logs for oops or panic messages referencing userfaultfd and UFFDIO_MOVE; inspect for unexpected process terminations during memory migration activities.

What your security team should do

• Prioritize kernel updates containing the referenced commit for systems using userfaultfd
• Monitor for kernel oops or crashes involving userfaultfd and UFFDIO_MOVE
• Review workloads that perform memory migration to assess exposure