CVE-2025-22090
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-22090
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22090.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-22090
- Downstream
- Related
- Published
- 2025-04-16T14:12:42Z
- Modified
- 2025-10-16T00:36:31.530969Z
- Summary
- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
x86/mm/pat: Fix VMPAT handling when fork() fails in copypage_range()
If trackpfncopy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables.
Consequently untrackpfn() will see VMPAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied.
The easiest fix would be to simply clear the VMPAT flag of the dst VMA if trackpfncopy() fails. However, the whole thing is about "simply" clearing the VMPAT flag is shaky as well: if we passed trackpfncopy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong.
So let's fix it properly: set the VMPAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VMPAT flag after undoing the reservation.
Note that any copied page table entries will get zapped when the VMA will get removed later, after copypagerange() succeeded; as VMPAT is not set then, we won't try cleaning VMPAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process will never run.
A reproducer can trigger this usually at the first try:
https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c
WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 getpatinfo+0xf6/0x110 Modules linked in: ... CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:getpatinfo+0xf6/0x110 ... Call Trace: <TASK> ... untrackpfn+0x52/0x110 unmapsinglevma+0xa6/0xe0 unmapvmas+0x105/0x1f0 exitmmap+0xf6/0x460 _mmput+0x4b/0x120 copyprocess+0x1bf6/0x2aa0 kernelclone+0xab/0x440 _dosysclone+0x66/0x90 dosyscall_64+0x95/0x180
Likely this case was missed in:
d155df53f310 ("x86/mm/pat: clear VMPAT if copyp4d_range failed")
... and instead of undoing the reservation we simply cleared the VM_PAT flag.
Keep the documentation of these functions in include/linux/pgtable.h, one place is more than sufficient -- we should clean that up for the other functions like trackpfnremap/untrack_pfn separately.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/8d6373f83f367dbed316ddeb178130a3a64b5b67
- https://git.kernel.org/stable/c/b07398e8a5da517083f5c3f2daa8f6681b48ab28
- https://git.kernel.org/stable/c/da381c33f3aa6406406c9fdf07b8b0b63e0ce722
- https://git.kernel.org/stable/c/dc84bc2aba85a1508f04a936f9f9a15f64ebfb31
- https://git.kernel.org/stable/c/de6185b8892d88142ef69768fe4077cbf40109c0
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2ab640379a0ab4cef746ced1d7e04a0941774bcbFixedb07398e8a5da517083f5c3f2daa8f6681b48ab28
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2ab640379a0ab4cef746ced1d7e04a0941774bcbFixed8d6373f83f367dbed316ddeb178130a3a64b5b67
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2ab640379a0ab4cef746ced1d7e04a0941774bcbFixedda381c33f3aa6406406c9fdf07b8b0b63e0ce722
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2ab640379a0ab4cef746ced1d7e04a0941774bcbFixedde6185b8892d88142ef69768fe4077cbf40109c0
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced2ab640379a0ab4cef746ced1d7e04a0941774bcbFixeddc84bc2aba85a1508f04a936f9f9a15f64ebfb31