CVE-2025-40040
mm/ksm: fix flag-dropping behavior in ksm_madvise
Description
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460 <snip other registers, drop unreliable trace> [ 44.617726] Call Trace: [ 44.617926] <TASK> [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP: 0033:0x7f365bb3f227 Kernel panics because it detects UFFD inconsistency during userfaultfd_release_all(). Specifically, a VMA which has a valid pointer to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags. The inconsistency is caused in ksm_madvise(): when user calls madvise() with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode, it accidentally clears all flags stored in the upper 32 bits of vma->vm_flags. Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and int are 32-bit wide. This setup causes the following mishap during the &= ~VM_MERGEABLE assignment. VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then promoted to unsigned long before the & operation. This promotion fills upper 32 bits with leading 0s, as we're doing unsigned conversion (and even for a signed conversion, this wouldn't help as the leading bit is 0). & operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears the upper 32-bits of its value. Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the BIT() macro. Note: other VM_* flags are not affected: This only happens to the VM_MERGEABLE flag, as the other VM_* flags are all constants of type int and after ~ operation, they end up with leading 1 and are thus converted to unsigned long with leading 1s. Note 2: After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is no longer a kernel BUG, but a WARNING at the same place: [ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067 but the root-cause (flag-drop) remains the same. [[email protected]: rust bindgen wasn't able to handle BIT(), from Miguel]
INFO
Published Date :
Oct. 28, 2025, 12:15 p.m.
Last Modified :
Oct. 19, 2026, 9:10 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel.
- Apply the provided patch.
- Rebuild and install the kernel.
Public PoC/Exploit Available at Github
CVE-2025-40040 has a 4 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-40040.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-40040 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-40040
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Mirror of https://github.com/nomi-sec/PoC-in-GitHub
3 linux kernel bugs chains to do secure comm app using side channel to establish key and establish covert channe;
Makefile Python Shell C
None
A collection of links related to Linux kernel security and exploitation
linux-kernel kernel-exploitation exploit privilege-escalation security
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-40040 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-40040 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 19, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: mm/ksm: corrige el comportamiento de eliminación de banderas en ksm_madvise syzkaller descubrió el siguiente fallo: (BUG del kernel) [ 44.607039] ------------[ cortar aquí ]------------ [ 44.607422] BUG del kernel en mm/userfaultfd.c:2067! [ 44.608148] Oops: código de operación inválido: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproductor No contaminado 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460 <se omiten otros registros, se descarta el rastreo no fiable> [ 44.617726] Rastreo de Llamadas: [ 44.617926] <TAREA> [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP: 0033:0x7f365bb3f227 El kernel entra en pánico porque detecta una inconsistencia de UFFD durante userfaultfd_release_all(). Específicamente, un VMA que tiene un puntero válido a vma->vm_userfaultfd_ctx, pero sin banderas UFFD en vma->vm_flags. La inconsistencia es causada en ksm_madvise(): cuando el usuario llama a madvise() con MADV_UNMEARGEABLE en un VMA que está registrado para UFFD en modo MINOR, borra accidentalmente todas las banderas almacenadas en los 32 bits superiores de vma->vm_flags. Asumiendo una compilación del kernel x86_64, unsigned long es de 64 bits y unsigned int e int son de 32 bits de ancho. Esta configuración causa el siguiente percance durante la asignación &= ~VM_MERGEABLE. VM_MERGEABLE es una constante de 32 bits de tipo unsigned int, 0x8000'0000. Después de aplicar ~, se convierte en 0x7fff'ffff unsigned int, que luego se promociona a unsigned long antes de la operación &. Esta promoción llena los 32 bits superiores con ceros iniciales, ya que estamos haciendo una conversión sin signo (e incluso para una conversión con signo, esto no ayudaría ya que el bit inicial es 0). La operación & termina haciendo un AND de vm_flags con 0x0000'0000'7fff'ffff en lugar del 0xffff'ffff'7fff'ffff previsto y, por lo tanto, borra accidentalmente los 32 bits superiores de su valor. Corrígelo cambiando la constante VM_MERGEABLE a unsigned long, usando la macro BIT(). Nota: otras banderas VM_* no se ven afectadas: Esto solo le ocurre a la bandera VM_MERGEABLE, ya que las otras banderas VM_* son todas constantes de tipo int y después de la operación ~, terminan con un 1 inicial y por lo tanto se convierten a unsigned long con 1s iniciales. Nota 2: Después del commit 31defc3b01d9 ('userfaultfd: remove (VM_)BUG_ON()s'), esto ya no es un BUG del kernel, sino una ADVERTENCIA en el mismo lugar: [ 45.595973] ADVERTENCIA: CPU: 1 PID: 2474 en mm/userfaultfd.c:2067 pero la causa raíz (eliminación de bandera) sigue siendo la misma. [[email protected]: rust bindgen no pudo manejar BIT(), de Miguel] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 15, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-40040', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-15T21:56:21.086400Z'} -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 15, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 Added Reference https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe Added Reference https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239 Added Reference https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71 Added Reference https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 Added Reference https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 Added Reference https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd Added Reference https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 Removed Reference https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 Removed Reference https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe Removed Reference https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239 Removed Reference https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71 Removed Reference https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 Removed Reference https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 Removed Reference https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd Removed Reference https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 Removed Reference Type https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 Types: Patch Removed Reference Type https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe Types: Patch Removed Reference Type https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239 Types: Patch Removed Reference Type https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71 Types: Patch Removed Reference Type https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 Types: Patch Removed Reference Type https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 Types: Patch Removed Reference Type https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd Types: Patch Removed Reference Type https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 30, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': '850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71', 'versionType': 'git'}, {'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': '788e5385d0ff69cdba1cabccb9dab8d9647b9239', 'versionType': 'git'}, {'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': 'b69f19244c2b6475c8a6eb72f0fb0d53509e48cd', 'versionType': 'git'}, {'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': '41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693', 'versionType': 'git'}, {'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': '92b82e232b8d8b116ac6e57aeae7a6033db92c60', 'versionType': 'git'}, {'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': 'ac50c6e0a8f91a02b681af81abb2362fbb67cc18', 'versionType': 'git'}, {'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': '76385629f45740b7888f8fcd83bde955b10f61fe', 'versionType': 'git'}, {'status': 'affected', 'version': '63c17fb8e5a46a16e10e82005748837fd11a2024', 'lessThan': 'f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93', 'versionType': 'git'}], 'programFiles': ['include/linux/mm.h', 'rust/bindings/bindings_helper.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.4.302', 'versionType': 'semver', 'lessThanOrEqual': '5.4.*'}, {'status': 'unaffected', 'version': '5.10.247', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.197', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.158', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.114', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.55', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.17.3', 'versionType': 'semver', 'lessThanOrEqual': '6.17.*'}, {'status': 'unaffected', 'version': '6.18', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['include/linux/mm.h', 'rust/bindings/bindings_helper.h'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Feb. 26, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.17.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.6 up to (excluding) 5.4.302 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.197 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.158 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.247 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.114 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.55 Added Reference Type kernel.org: https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jan. 26, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239 Added Reference https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Dec. 06, 2025
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 29, 2025
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 28, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460 <snip other registers, drop unreliable trace> [ 44.617726] Call Trace: [ 44.617926] <TASK> [ 44.619284] userfaultfd_release+0xef/0x1b0 [ 44.620976] __fput+0x3f9/0xb60 [ 44.621240] fput_close_sync+0x110/0x210 [ 44.622222] __x64_sys_close+0x8f/0x120 [ 44.622530] do_syscall_64+0x5b/0x2f0 [ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 44.623244] RIP: 0033:0x7f365bb3f227 Kernel panics because it detects UFFD inconsistency during userfaultfd_release_all(). Specifically, a VMA which has a valid pointer to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags. The inconsistency is caused in ksm_madvise(): when user calls madvise() with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode, it accidentally clears all flags stored in the upper 32 bits of vma->vm_flags. Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and int are 32-bit wide. This setup causes the following mishap during the &= ~VM_MERGEABLE assignment. VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then promoted to unsigned long before the & operation. This promotion fills upper 32 bits with leading 0s, as we're doing unsigned conversion (and even for a signed conversion, this wouldn't help as the leading bit is 0). & operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears the upper 32-bits of its value. Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the BIT() macro. Note: other VM_* flags are not affected: This only happens to the VM_MERGEABLE flag, as the other VM_* flags are all constants of type int and after ~ operation, they end up with leading 1 and are thus converted to unsigned long with leading 1s. Note 2: After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is no longer a kernel BUG, but a WARNING at the same place: [ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067 but the root-cause (flag-drop) remains the same. [[email protected]: rust bindgen wasn't able to handle BIT(), from Miguel] Added Reference https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe Added Reference https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60 Added Reference https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18 Added Reference https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93