CVE-2025-39845

What it actually does

Missing page table synchronization in x86 4-level paging during p*d_populate_kernel() calls for persistent memory and device memory mappings leads to not-present page faults and kernel crashes in functions such as __init_single_page() and vmemmap_set_pmd().

Why it matters to the business

Systems with large persistent memory or certain device drivers experience intermittent boot failures and crashes during memory initialization, resulting in extended downtime and requiring kernel updates or workarounds on affected Linux distributions.

How an attack unfolds

An attacker with local access can trigger device memory mapping paths (for example via device_dax or graphics drivers) that exercise the unsynchronized page tables on 4-level paging systems; the resulting page faults during early memory setup cause denial of service. Related threat actors such as VMSCAPE have been observed targeting similar Linux kernel memory issues on container-optimized platforms.

How to fix it

Upgrade to a kernel containing commit 744ff519c72de31344a627eaf9b24e9595aae554 or later; for Debian 11 and 12 packages update sks to version 1.1.5-1. Reboot after installation and verify page table synchronization behavior on affected hardware.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or package version; perform boot tests with persistent memory enabled and monitor for page fault oops in memremap_pages or vmemmap paths.

Typical attack path

1. Obtain local access on a 4-level paging system with persistent memory or device_dax support
2. Trigger memremap_pages or vmemmap population through a device probe or driver load
3. Cause unsynchronized PGD/P4D entries to be dereferenced before sync_global_pgds
4. Trigger kernel page fault leading to oops and system instability

How to detect it

Review kernel logs for oops messages containing __init_single_page, vmemmap_set_pmd, memremap_pages, or devm_memremap_pages during early boot; correlate with hardware having persistent memory or device_dax modules on 4-level paging systems.

What your security team should do

• Prioritize kernel updates on systems using 4-level paging and persistent memory or device memory drivers
• Monitor for related Linux kernel memory mapping issues reported under similar CVEs
• Test patched kernels in staging environments before production rollout
• Review hardware configurations for large PMEM deployments