Cloudanix VulnDB

CVE-2025-68231

None

CVSS

—

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in the operating system's memory handling could cause computers to crash unexpectedly under certain memory setups.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The mempool poisoning logic fails to properly map individual pages for high-order allocations when HIGHMEM is enabled, resulting in writes to unmapped page addresses and kernel page faults during poison_element calls.

Why it matters to the business

Systems may experience unexpected crashes or instability during memory pool initialization or allocation, potentially affecting availability of services relying on the kernel in environments with HIGHMEM enabled.

How an attack unfolds

An attacker could trigger the condition by causing allocation of high-order mempool pages under HIGHMEM configuration, leading to a denial of service via kernel oops during initialization paths such as bio_integrity_initfn. No known threat actors or ransomware campaigns are associated with this issue.

How to fix it

Update the Linux kernel to a version containing the fix for high-order HIGHMEM page poisoning, such as commit ea4131665107e66ece90e66bcec1a2f1246cbd41 or equivalent fixed releases in downstream packages.

How to confirm the fix worked

Confirm the presence of the fix commit in kernel source, or test mempool initialization with HIGHMEM enabled and order > 0 pages to ensure no page faults occur in poison_element.

Typical attack path

  1. Configure or encounter HIGHMEM with high-order page allocations in mempool
  2. Invoke mempool_init_node or related initialization
  3. Execute poison_element on unmapped pages
  4. Trigger kernel page fault and oops

How to detect it

Inspect kernel logs and oops reports for page faults originating from mempool.c poison_element or mempool_init_node functions during early boot or allocation.

What your security team should do

  • Apply kernel updates promptly on systems using HIGHMEM configurations
  • Review boot and kernel logs for related page fault patterns post-update
  • Test memory-intensive workloads after patching to validate stability

The record

In the Linux kernel, the following vulnerability has been resolved: mm/mempool: fix poisoning order>0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page *pde = 03171067 *pte = 00000000 Oops: Oops: 0002 [#1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17) Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56 EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287 CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690 Call Trace: poison_element (mm/mempool.c:83 mm/mempool.c:102) mempool_init_node (mm/mempool.c:142 mm/mempool.c:226) mempool_init_noprof (mm/mempool.c:250 (discriminator 1)) ? mempool_alloc_pages (mm/mempool.c:640) bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8)) ? mempool_alloc_pages (mm/mempool.c:640) do_one_initcall (init/main.c:1283) Christoph found out this is due to the poisoning code not dealing properly with CONFIG_HIGHMEM because only the first page is mapped but then the whole potentially high-order page is accessed. We could give up on HIGHMEM here, but it's straightforward to fix this with a loop that's mapping, poisoning or checking and unmapping individual pages.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.1.0 6.1.159
Mageia:9 kernel 0 6.6.120-1.mga9
Mageia:9 kernel-linus 0 6.6.120-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.14-14.mga9
Mageia:9 kmod-xtables-addons 0 3.24-88.mga9

Related vulnerabilities