Linux azure: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with… (CVE-2025-40006)
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with fallocating hole. remove_inode_single_folio will unmap the folio if the folio is still mapped. However, it's called without folio lock. If the folio is migrated and the mapped pte has been converted to migration entry, folio_mapped() returns false, and won't unmap it. Due to extra refcount held by remove_inode_single_folio, migration fails, restores migration entry to normal pte, and the folio is mapped again. As a result, we triggered BUG in filemap_unaccount_folio. The log is as follows: BUG: Bad page cache in process hugetlb pfn:156c00 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file" flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f4(hugetlb) page dumped because: still mapped when deleted CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x4f/0x70 filemap_unaccount_folio+0xc4/0x1c0 __filemap_remove_folio+0x38/0x1c0 filemap_remove_folio+0x41/0xd0 remove_inode_hugepages+0x142/0x250 hugetlbfs_fallocate+0x471/0x5a0 vfs_fallocate+0x149/0x380 Hold folio lock before checking if the folio is mapped to avold race with migration.
AI Analysis
Technical Summary
CVE-2025-40006 addresses a race condition in the Linux kernel hugetlb memory management code. Specifically, remove_inode_single_folio is called without holding the folio lock, which can cause it to miss unmapping a folio if the folio is concurrently migrated and the page table entry converted to a migration entry. This results in an inconsistent page cache state and triggers a kernel BUG in filemap_unaccount_folio. The fix involves holding the folio lock before checking if the folio is mapped to avoid the race with migration.
Potential Impact
The vulnerability can cause a kernel BUG due to inconsistent page cache state, potentially leading to system crashes or instability. The CVSS vector indicates high impact on confidentiality, integrity, and availability, but no known exploits are reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to hold the folio lock before checking if the folio is mapped, preventing the race condition. Users should apply the official kernel update that includes this patch. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.
Linux azure: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with… (CVE-2025-40006)
Description
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with fallocating hole. remove_inode_single_folio will unmap the folio if the folio is still mapped. However, it's called without folio lock. If the folio is migrated and the mapped pte has been converted to migration entry, folio_mapped() returns false, and won't unmap it. Due to extra refcount held by remove_inode_single_folio, migration fails, restores migration entry to normal pte, and the folio is mapped again. As a result, we triggered BUG in filemap_unaccount_folio. The log is as follows: BUG: Bad page cache in process hugetlb pfn:156c00 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file" flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f4(hugetlb) page dumped because: still mapped when deleted CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x4f/0x70 filemap_unaccount_folio+0xc4/0x1c0 __filemap_remove_folio+0x38/0x1c0 filemap_remove_folio+0x41/0xd0 remove_inode_hugepages+0x142/0x250 hugetlbfs_fallocate+0x471/0x5a0 vfs_fallocate+0x149/0x380 Hold folio lock before checking if the folio is mapped to avold race with migration.
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-40006 addresses a race condition in the Linux kernel hugetlb memory management code. Specifically, remove_inode_single_folio is called without holding the folio lock, which can cause it to miss unmapping a folio if the folio is concurrently migrated and the page table entry converted to a migration entry. This results in an inconsistent page cache state and triggers a kernel BUG in filemap_unaccount_folio. The fix involves holding the folio lock before checking if the folio is mapped to avoid the race with migration.
Potential Impact
The vulnerability can cause a kernel BUG due to inconsistent page cache state, potentially leading to system crashes or instability. The CVSS vector indicates high impact on confidentiality, integrity, and availability, but no known exploits are reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to hold the folio lock before checking if the folio is mapped, preventing the race condition. Users should apply the official kernel update that includes this patch. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3f8h-q5gp-rc64
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40006"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d79c2644c7f847b7fa
Added to database: 07/30/2026, 15:50:47 UTC
Last enriched: 07/30/2026, 15:57:20 UTC
Last updated: 08/22/2026, 10:52:05 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.