In the Linux kernel, the following vulnerability has been resolved:
VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify
During our test, it is found that a warning can be trigger in trygrabfolio as follow:
------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 trygrabfolio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:trygrabfolio+0x106/0x130 Call Trace: <TASK> followhugepmd+0x240/0x8e0 followpmdmask.constprop.0.isra.0+0x40b/0x5c0 followpudmask.constprop.0.isra.0+0x14a/0x170 followpagemask+0x1c2/0x1f0 __getuserpages+0x176/0x950 _guplongtermlocked+0x15b/0x1060 ? gupfast+0x120/0x1f0 gupfastfallback+0x17e/0x230 getuserpagesfast+0x5f/0x80 vmcihostunlockedioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]---
Digging into the source, context->notifypage may init by getuserpagesfast and can be seen in vmcictxunsetnotify which will try to putpage. However getuserpagesfast is not finished here and lead to following trygrab_folio warning. The race condition is shown as follow:
cpu0 cpu1 vmcihostdosetnotify vmcihostsetupnotify getuserpagesfast(uva, 1, FOLLWRITE, &context->notifypage); locklesspagesfrommm guppgdrange guphugepmd // update &context->notifypage vmcihostdosetnotify vmcictxunsetnotify notifypage = context->notifypage; if (notifypage) putpage(notifypage); // page is freed __guplongtermlocked _getuserpages followtranshugepmd trygrabfolio // warn here
To slove this, use local variable page to make notifypage can be seen after finish getuserpagesfast.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38102.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38102.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b5313c80c39a26d27cbb602f968a05576c36f9",
"deprecated": false,
"digest": {
"line_hashes": [
"2215117009526832554474048207744672741",
"83335548774087915851076779032122658523",
"140077251941887751897729703812508787365",
"223658282606995004905769933065344775648",
"328595689973590381320768679610960925491",
"14624524654125642838824256915722739949",
"104405330168398704239672198119828961788",
"203947329171151402256099258354137914205",
"64016605658366868495988785281391860179",
"194829106149546309668783441718506095268",
"329438886189348524711971340759298727209",
"326759849546382326114560409754754011774",
"204615412348208594063119049489645336944",
"63692510736341806431375006840655220857"
],
"threshold": 0.9
},
"id": "CVE-2025-38102-7fe9258b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_host.c",
"function": "vmci_host_setup_notify"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@75b5313c80c39a26d27cbb602f968a05576c36f9",
"deprecated": false,
"digest": {
"function_hash": "22997674535976637161686852822623541639",
"length": 607.0
},
"id": "CVE-2025-38102-d81e14c5",
"signature_type": "Function"
}
]