In the Linux kernel, the following vulnerability has been resolved:
mm/ptdump: take the memory hotplug lock inside ptdumpwalkpgd()
Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful.
But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems.
To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernelpagetables.
Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernelpagetables/checkwxpages which in turn calls ptdumpcheckwx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdumpcheckwx() which will benefit both the scenarios.
Drop getonlinemems() and putonlinemems() combination from all existing platform ptdump code paths.
[
{
"id": "CVE-2025-38681-16da24ec",
"signature_version": "v1",
"digest": {
"length": 140.0,
"function_hash": "24427577156767427526601555420833154987"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "arch/riscv/mm/ptdump.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-1be8c91c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287311418714322241109310721915886961166",
"263912792527149547739995223438591248076",
"333575150865713608236217050170917971634",
"177416090191313546201826375188128513",
"74561668346199805567373198218022141106",
"273541799759379916880416241427625594503"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1636b5e9c3543b87d673e32a47e7c18698882425",
"target": {
"file": "mm/ptdump.c"
}
},
{
"id": "CVE-2025-38681-2252c8c0",
"signature_version": "v1",
"digest": {
"length": 160.0,
"function_hash": "211220783719411960378073749139876069635"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-239deb91",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82703682370441251805480313330801276936",
"189995686947040553013616118173947354667",
"34302137892851881137854887940203102064",
"3112385571139555873951373455548397538",
"24894047453317124353096837543480961841",
"313261306509050600007645106168424214003",
"208394096254424141819856610597917287309",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee9a8c27bfd72c3f465004fa8455785d61be5e8",
"target": {
"file": "arch/s390/mm/dump_pagetables.c"
}
},
{
"id": "CVE-2025-38681-29b79061",
"signature_version": "v1",
"digest": {
"length": 160.0,
"function_hash": "211220783719411960378073749139876069635"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1636b5e9c3543b87d673e32a47e7c18698882425",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-2f7a6695",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92819621131115345401137544596119591482",
"865670455125283789667526135636113243",
"320323319593258468261326014134670864303",
"122227252285045596629175929126570849376",
"90980204747405440264633390483972831023",
"172205600700089496239054828379291795803",
"187302473326111320492567825782691094078",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee9a8c27bfd72c3f465004fa8455785d61be5e8",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c"
}
},
{
"id": "CVE-2025-38681-353d983b",
"signature_version": "v1",
"digest": {
"length": 320.0,
"function_hash": "232944483610504469629907831272151711796"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "mm/ptdump.c",
"function": "ptdump_walk_pgd"
}
},
{
"id": "CVE-2025-38681-3f31ec84",
"signature_version": "v1",
"digest": {
"length": 515.0,
"function_hash": "176646776758643498769586309300459854862"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "arch/s390/mm/dump_pagetables.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-51c2fe49",
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "239022363567454947673073606563897315253"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee9a8c27bfd72c3f465004fa8455785d61be5e8",
"target": {
"file": "arch/s390/mm/dump_pagetables.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-53f391ab",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287311418714322241109310721915886961166",
"263912792527149547739995223438591248076",
"333575150865713608236217050170917971634",
"177416090191313546201826375188128513",
"74561668346199805567373198218022141106",
"273541799759379916880416241427625594503",
"148759037528169040969159832708705146291"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "mm/ptdump.c"
}
},
{
"id": "CVE-2025-38681-597c4fc5",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287311418714322241109310721915886961166",
"263912792527149547739995223438591248076",
"333575150865713608236217050170917971634",
"177416090191313546201826375188128513",
"74561668346199805567373198218022141106",
"273541799759379916880416241427625594503"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee9a8c27bfd72c3f465004fa8455785d61be5e8",
"target": {
"file": "mm/ptdump.c"
}
},
{
"id": "CVE-2025-38681-61aaf1fe",
"signature_version": "v1",
"digest": {
"length": 320.0,
"function_hash": "232944483610504469629907831272151711796"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "mm/ptdump.c",
"function": "ptdump_walk_pgd"
}
},
{
"id": "CVE-2025-38681-62b403dc",
"signature_version": "v1",
"digest": {
"length": 320.0,
"function_hash": "232944483610504469629907831272151711796"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee9a8c27bfd72c3f465004fa8455785d61be5e8",
"target": {
"file": "mm/ptdump.c",
"function": "ptdump_walk_pgd"
}
},
{
"id": "CVE-2025-38681-6bfe2227",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"82703682370441251805480313330801276936",
"189995686947040553013616118173947354667",
"34302137892851881137854887940203102064",
"3112385571139555873951373455548397538",
"24894047453317124353096837543480961841",
"313261306509050600007645106168424214003",
"208394096254424141819856610597917287309",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1636b5e9c3543b87d673e32a47e7c18698882425",
"target": {
"file": "arch/s390/mm/dump_pagetables.c"
}
},
{
"id": "CVE-2025-38681-6e1280a9",
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "239022363567454947673073606563897315253"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1636b5e9c3543b87d673e32a47e7c18698882425",
"target": {
"file": "arch/s390/mm/dump_pagetables.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-a9bff84a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92819621131115345401137544596119591482",
"865670455125283789667526135636113243",
"320323319593258468261326014134670864303",
"122227252285045596629175929126570849376",
"90980204747405440264633390483972831023",
"172205600700089496239054828379291795803",
"187302473326111320492567825782691094078",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c"
}
},
{
"id": "CVE-2025-38681-b0490cf8",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"51724457950839302490400805316753694259",
"48295375089181701779197679465822050087",
"34302137892851881137854887940203102064",
"3112385571139555873951373455548397538",
"24894047453317124353096837543480961841",
"313261306509050600007645106168424214003",
"208394096254424141819856610597917287309",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "arch/s390/mm/dump_pagetables.c"
}
},
{
"id": "CVE-2025-38681-b1504014",
"signature_version": "v1",
"digest": {
"length": 515.0,
"function_hash": "176646776758643498769586309300459854862"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "arch/s390/mm/dump_pagetables.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-b2df7b57",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92516020246218196087580587775787531182",
"174359888078065592688153995089402403213",
"204590122996891531243123944940470843398",
"116211086176965079679562288377526254731",
"235679574017300398174322651386203318238",
"268663817081637315333484842144335897430",
"246713337925225787451758804092613063414",
"97750685149256036378541290400794134979",
"294214755660368028114349516294662588733",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "arch/riscv/mm/ptdump.c"
}
},
{
"id": "CVE-2025-38681-b880bbfe",
"signature_version": "v1",
"digest": {
"length": 160.0,
"function_hash": "211220783719411960378073749139876069635"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-bb5c9bd5",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92819621131115345401137544596119591482",
"865670455125283789667526135636113243",
"320323319593258468261326014134670864303",
"122227252285045596629175929126570849376",
"90980204747405440264633390483972831023",
"172205600700089496239054828379291795803",
"187302473326111320492567825782691094078",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1636b5e9c3543b87d673e32a47e7c18698882425",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c"
}
},
{
"id": "CVE-2025-38681-c007a444",
"signature_version": "v1",
"digest": {
"length": 320.0,
"function_hash": "232944483610504469629907831272151711796"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1636b5e9c3543b87d673e32a47e7c18698882425",
"target": {
"file": "mm/ptdump.c",
"function": "ptdump_walk_pgd"
}
},
{
"id": "CVE-2025-38681-cc931ce2",
"signature_version": "v1",
"digest": {
"length": 160.0,
"function_hash": "211220783719411960378073749139876069635"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee9a8c27bfd72c3f465004fa8455785d61be5e8",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-d5a70ee4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92819621131115345401137544596119591482",
"865670455125283789667526135636113243",
"320323319593258468261326014134670864303",
"122227252285045596629175929126570849376",
"90980204747405440264633390483972831023",
"172205600700089496239054828379291795803",
"187302473326111320492567825782691094078",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "arch/arm64/mm/ptdump_debugfs.c"
}
},
{
"id": "CVE-2025-38681-dc83031c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287311418714322241109310721915886961166",
"263912792527149547739995223438591248076",
"333575150865713608236217050170917971634",
"177416090191313546201826375188128513",
"74561668346199805567373198218022141106",
"273541799759379916880416241427625594503",
"148759037528169040969159832708705146291"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "mm/ptdump.c"
}
},
{
"id": "CVE-2025-38681-e728cc7a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"92516020246218196087580587775787531182",
"174359888078065592688153995089402403213",
"204590122996891531243123944940470843398",
"116211086176965079679562288377526254731",
"235679574017300398174322651386203318238",
"268663817081637315333484842144335897430",
"246713337925225787451758804092613063414",
"97750685149256036378541290400794134979",
"294214755660368028114349516294662588733",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "arch/riscv/mm/ptdump.c"
}
},
{
"id": "CVE-2025-38681-ea9fa64a",
"signature_version": "v1",
"digest": {
"length": 140.0,
"function_hash": "24427577156767427526601555420833154987"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff40839e018b82c4d756d035f34a63aa2d93be83",
"target": {
"file": "arch/riscv/mm/ptdump.c",
"function": "ptdump_show"
}
},
{
"id": "CVE-2025-38681-f0724c2b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"51724457950839302490400805316753694259",
"48295375089181701779197679465822050087",
"34302137892851881137854887940203102064",
"3112385571139555873951373455548397538",
"24894047453317124353096837543480961841",
"313261306509050600007645106168424214003",
"208394096254424141819856610597917287309",
"101568211197649167406051608803173457457"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67995d4244694928ce701928e530b5b4adeb17b4",
"target": {
"file": "arch/s390/mm/dump_pagetables.c"
}
}
]