CVE-2025-37922 is a vulnerability in the Linux kernel related to the handling of the virtual memory map (vmemmap) for struct pages within namespaces, specifically in the book3s64/radix architecture. The issue arises from improper alignment of the vmemmap section start address to PAGE_SIZE, which can cause the altmap page allocated for one namespace to be incorrectly shared with a previous namespace. This misalignment leads to a scenario where, during the free operation, the previous namespace may mistakenly treat the shared altmap page as a normal page and attempt to free it. This results in a kernel crash due to double freeing or invalid memory operations. Additionally, if no altmap is present, a PMD-sized vmemmap page may be allocated without proper alignment, triggering a VM_BUG_ON error when setting the page table. The vulnerability manifests as a NULL pointer dereference and kernel panic, as evidenced by the kernel oops logs showing a crash in get_pfnblock_flags_mask and related memory management functions. The root cause is the lack of alignment of the vmemmap start address, which the patch addresses by enforcing PAGE_SIZE alignment. This ensures that the start address does not belong to the current namespace, allowing normal pages to be allocated and freed correctly, preventing cross-namespace altmap sharing and associated crashes. The vulnerability affects Linux kernel versions identified by the commit hash 368a0590d954a659b16ab945328ada0cc10f93a0 and is specific to systems using the radix MMU with large PAGE_SIZE (64K) configurations, typical in pSeries architectures. No known exploits are reported in the wild as of publication, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a significant risk primarily to servers and infrastructure running affected Linux kernel versions on hardware architectures using radix MMU with large page sizes, such as IBM pSeries systems. The impact includes potential denial of service (DoS) due to kernel crashes, which can disrupt critical services and applications. Organizations relying on virtualization or containerization that use namespaces extensively may experience instability or crashes, leading to downtime and potential data loss. Although the vulnerability does not directly enable privilege escalation or arbitrary code execution, the kernel panic can be triggered by local users or processes with sufficient privileges, potentially allowing attackers to cause service interruptions. This is particularly concerning for data centers, cloud providers, and enterprises with high availability requirements. The lack of known exploits reduces immediate risk, but the complexity of the issue and kernel-level impact necessitate prompt attention. The vulnerability also complicates memory management and may affect system reliability and performance if unpatched.

European organizations should prioritize updating their Linux kernels to versions that include the patch aligning the vmemmap start address to PAGE_SIZE, as this directly addresses the root cause. Specifically, kernel versions incorporating commit 368a0590d954a659b16ab945328ada0cc10f93a0 or later should be deployed. For environments where immediate patching is not feasible, organizations should restrict access to systems running affected kernels, especially limiting local user privileges to prevent exploitation attempts. Monitoring kernel logs for oops or NULL pointer dereference messages related to vmemmap or memory management can help detect attempted exploitation or instability. Additionally, organizations should review their use of namespaces and memory management configurations on affected architectures, possibly disabling or limiting features that rely heavily on altmap allocations until patched. Implementing robust backup and recovery procedures will mitigate the impact of potential crashes. Collaboration with hardware vendors and Linux distribution maintainers to obtain timely patches and guidance is also recommended.