CVE-2025-39754

What it actually does

Race condition in smaps_hugetlb_range() allows concurrent execution with migrate_pages without ptl lock, triggering BUG_ON in pfn_swap_entry_to_page during huge page handling.

Why it matters to the business

System crashes or instability on Linux kernels using huge pages, disrupting availability in high-memory workloads such as containers; widespread kernel exposure increases operational risk across many environments.

How an attack unfolds

Local attacker triggers page migration via migrate_pages while concurrently invoking smaps_hugetlb_range through /proc reads on processes using huge pages; absence of ptl lock leads to invalid folio access and kernel BUG_ON. Related activity from actors including VMSCAPE and campaigns targeting container-optimized OS privilege escalations (CVE-2024-58240, CVE-2025-39682) illustrates the pattern of kernel memory timing attacks.

How to fix it

Apply kernel patch updating to commit 2a1f3663974162b8f1e098196f557cfc1d160138 or equivalent stable release that holds ptl lock in smaps_hugetlb_range(). Rebuild and reboot with updated kernel.

How to confirm the fix worked

Confirm kernel source contains ptl lock acquisition around huge_ptep_get and pfn_swap_entry_folio in smaps_hugetlb_range(); test with concurrent migration and smaps reads to ensure no BUG_ON occurs.

Typical attack path

1. Obtain local unprivileged access on target Linux system
2. Identify or create processes using huge pages
3. Trigger concurrent page migration operations
4. Read /proc/<pid>/smaps to invoke smaps_hugetlb_range without ptl
5. Induce BUG_ON crash via pfn_swap_entry_folio

How to detect it

Search kernel logs and dmesg for BUG_ON messages referencing pfn_swap_entry_to_page or pfn_swap_entry_folio during smaps_hugetlb_range activity; correlate with process migration events and /proc smaps reads. Include context from VMSCAPE-style privilege escalation attempts in container environments.

• BUG_ON.*pfn_swap_entry_to_page
• smaps_hugetlb_range.*migration
• huge_ptep_get without ptl
• folio_unlock.*remove_migration_ptes

What your security team should do

• Immediately update Linux kernels to the fixed commit across all affected systems
• Prioritize patching in container and high-memory environments due to observed threat actor interest in similar kernel races
• Enable kernel panic logging and monitoring for related BUG_ON signatures
• Review huge page usage and smaps access patterns in production workloads