In the Linux kernel, the following vulnerability has been resolved:
VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify
During our test, it is found that a warning can be trigger in trygrabfolio as follow:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 trygrabfolio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:trygrabfolio+0x106/0x130 Call Trace: <TASK> followhugepmd+0x240/0x8e0 followpmdmask.constprop.0.isra.0+0x40b/0x5c0 followpudmask.constprop.0.isra.0+0x14a/0x170 followpagemask+0x1c2/0x1f0 _getuserpages+0x176/0x950 _guplongtermlocked+0x15b/0x1060 ? gupfast+0x120/0x1f0 gupfastfallback+0x17e/0x230 getuserpagesfast+0x5f/0x80 vmcihostunlocked_ioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]---
Digging into the source, context->notifypage may init by getuserpagesfast and can be seen in vmcictxunsetnotify which will try to putpage. However getuserpagesfast is not finished here and lead to following trygrab_folio warning. The race condition is shown as follow:
cpu0 cpu1 vmcihostdosetnotify vmcihostsetupnotify getuserpagesfast(uva, 1, FOLLWRITE, &context->notifypage); locklesspagesfrommm guppgdrange guphugepmd // update &context->notifypage vmcihostdosetnotify vmcictxunsetnotify notifypage = context->notifypage; if (notifypage) putpage(notifypage); // page is freed _guplongtermlocked _getuserpages followtranshugepmd trygrab_folio // warn here
To slove this, use local variable page to make notifypage can be seen after finish getuserpagesfast.
[
{
"deprecated": false,
"id": "CVE-2025-38102-1e5a8b62",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bd6406fb5f36c2bb1e96e27d4c3e9f4d09edde4",
"digest": {
"line_hashes": [
"2215117009526832554474048207744672741",
"83335548774087915851076779032122658523",
"140077251941887751897729703812508787365",
"223658282606995004905769933065344775648",
"328595689973590381320768679610960925491",
"14624524654125642838824256915722739949",
"104405330168398704239672198119828961788",
"203947329171151402256099258354137914205",
"64016605658366868495988785281391860179",
"194829106149546309668783441718506095268",
"329438886189348524711971340759298727209",
"326759849546382326114560409754754011774",
"204615412348208594063119049489645336944",
"63692510736341806431375006840655220857"
],
"threshold": 0.9
},
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-244d68f2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00ddc7dad55b7bbb78df80d6e174d0c4764dea0c",
"digest": {
"line_hashes": [
"2215117009526832554474048207744672741",
"83335548774087915851076779032122658523",
"140077251941887751897729703812508787365",
"223658282606995004905769933065344775648",
"328595689973590381320768679610960925491",
"14624524654125642838824256915722739949",
"104405330168398704239672198119828961788",
"203947329171151402256099258354137914205",
"64016605658366868495988785281391860179",
"194829106149546309668783441718506095268",
"329438886189348524711971340759298727209",
"326759849546382326114560409754754011774",
"204615412348208594063119049489645336944",
"63692510736341806431375006840655220857"
],
"threshold": 0.9
},
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-2ae34bc2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74095bbbb19ca74a0368d857603a2438c88ca86c",
"digest": {
"function_hash": "149714759983246866165067836043547030230",
"length": 691.0
},
"target": {
"function": "vmci_host_setup_notify",
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-65ab97e8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e3af836805ed1d7a699f76ec798626198917aa4",
"digest": {
"line_hashes": [
"2215117009526832554474048207744672741",
"83335548774087915851076779032122658523",
"140077251941887751897729703812508787365",
"223658282606995004905769933065344775648",
"328595689973590381320768679610960925491",
"14624524654125642838824256915722739949",
"104405330168398704239672198119828961788",
"203947329171151402256099258354137914205",
"64016605658366868495988785281391860179",
"194829106149546309668783441718506095268",
"329438886189348524711971340759298727209",
"326759849546382326114560409754754011774",
"204615412348208594063119049489645336944",
"63692510736341806431375006840655220857"
],
"threshold": 0.9
},
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-6ca72b27",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e3af836805ed1d7a699f76ec798626198917aa4",
"digest": {
"function_hash": "22997674535976637161686852822623541639",
"length": 607.0
},
"target": {
"function": "vmci_host_setup_notify",
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-7fe9258b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b5313c80c39a26d27cbb602f968a05576c36f9",
"digest": {
"line_hashes": [
"2215117009526832554474048207744672741",
"83335548774087915851076779032122658523",
"140077251941887751897729703812508787365",
"223658282606995004905769933065344775648",
"328595689973590381320768679610960925491",
"14624524654125642838824256915722739949",
"104405330168398704239672198119828961788",
"203947329171151402256099258354137914205",
"64016605658366868495988785281391860179",
"194829106149546309668783441718506095268",
"329438886189348524711971340759298727209",
"326759849546382326114560409754754011774",
"204615412348208594063119049489645336944",
"63692510736341806431375006840655220857"
],
"threshold": 0.9
},
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-8343fe26",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@468aec888f838ce5174b96e0cb4396790d6f60ca",
"digest": {
"function_hash": "22997674535976637161686852822623541639",
"length": 607.0
},
"target": {
"function": "vmci_host_setup_notify",
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-a2342ca3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00ddc7dad55b7bbb78df80d6e174d0c4764dea0c",
"digest": {
"function_hash": "22997674535976637161686852822623541639",
"length": 607.0
},
"target": {
"function": "vmci_host_setup_notify",
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-d164cbf2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@468aec888f838ce5174b96e0cb4396790d6f60ca",
"digest": {
"line_hashes": [
"2215117009526832554474048207744672741",
"83335548774087915851076779032122658523",
"140077251941887751897729703812508787365",
"223658282606995004905769933065344775648",
"328595689973590381320768679610960925491",
"14624524654125642838824256915722739949",
"104405330168398704239672198119828961788",
"203947329171151402256099258354137914205",
"64016605658366868495988785281391860179",
"194829106149546309668783441718506095268",
"329438886189348524711971340759298727209",
"326759849546382326114560409754754011774",
"204615412348208594063119049489645336944",
"63692510736341806431375006840655220857"
],
"threshold": 0.9
},
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-d81e14c5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b5313c80c39a26d27cbb602f968a05576c36f9",
"digest": {
"function_hash": "22997674535976637161686852822623541639",
"length": 607.0
},
"target": {
"function": "vmci_host_setup_notify",
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-dd3a19f2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74095bbbb19ca74a0368d857603a2438c88ca86c",
"digest": {
"line_hashes": [
"2215117009526832554474048207744672741",
"83335548774087915851076779032122658523",
"140077251941887751897729703812508787365",
"223658282606995004905769933065344775648",
"122885764873816795376515897239315218312",
"14891025551218248698694742751333766304",
"194891033110081719474608658437114251041",
"203947329171151402256099258354137914205",
"64016605658366868495988785281391860179",
"194829106149546309668783441718506095268",
"329438886189348524711971340759298727209",
"326759849546382326114560409754754011774",
"204615412348208594063119049489645336944",
"63692510736341806431375006840655220857"
],
"threshold": 0.9
},
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2025-38102-e8f62714",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bd6406fb5f36c2bb1e96e27d4c3e9f4d09edde4",
"digest": {
"function_hash": "22997674535976637161686852822623541639",
"length": 607.0
},
"target": {
"function": "vmci_host_setup_notify",
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]