In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix use-after-free race in fault handler When a page fault occurs… (CVE-2025-40272)
A use-after-free race condition was identified and fixed in the Linux kernel's secret memory subsystem (memfd_secret). The flaw occurs when concurrent page faults on the same secret memory page cause improper ordering of freeing and remapping operations, potentially leading to supervisor not-present page faults. This vulnerability could impact confidentiality, integrity, and availability of the affected system. The issue has been resolved by correcting the order of operations in the fault handler to prevent the page from becoming prematurely available to the allocator.
AI Analysis
Technical Summary
CVE-2025-40272 describes a use-after-free race condition in the Linux kernel's secret memory file handling (memfd_secret). When two tasks concurrently fault on the same page, both allocate a folio and remove the page from the direct map, but only one successfully adds the folio to the file mapping. The failing task frees its folio and restores the page to the direct map in the wrong order, making the page available to the allocator before it is remapped. This can cause a supervisor not-present page fault if the page is accessed in this window. The fix corrects the ordering to restore the direct map before freeing the folio, eliminating the race condition.
Potential Impact
The vulnerability can cause kernel memory corruption leading to supervisor not-present page faults, which may result in system instability or crashes (denial of service). The CVSS vector indicates high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by correcting the order of operations in the fault handler. Users should apply the official kernel updates that include this fix. Since this is not a cloud service, remediation depends on deploying patched kernel versions. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the latest patch availability and deployment instructions.
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix use-after-free race in fault handler When a page fault occurs… (CVE-2025-40272)
Description
A use-after-free race condition was identified and fixed in the Linux kernel's secret memory subsystem (memfd_secret). The flaw occurs when concurrent page faults on the same secret memory page cause improper ordering of freeing and remapping operations, potentially leading to supervisor not-present page faults. This vulnerability could impact confidentiality, integrity, and availability of the affected system. The issue has been resolved by correcting the order of operations in the fault handler to prevent the page from becoming prematurely available to the allocator.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-40272 describes a use-after-free race condition in the Linux kernel's secret memory file handling (memfd_secret). When two tasks concurrently fault on the same page, both allocate a folio and remove the page from the direct map, but only one successfully adds the folio to the file mapping. The failing task frees its folio and restores the page to the direct map in the wrong order, making the page available to the allocator before it is remapped. This can cause a supervisor not-present page fault if the page is accessed in this window. The fix corrects the ordering to restore the direct map before freeing the folio, eliminating the race condition.
Potential Impact
The vulnerability can cause kernel memory corruption leading to supervisor not-present page faults, which may result in system instability or crashes (denial of service). The CVSS vector indicates high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by correcting the order of operations in the fault handler. Users should apply the official kernel updates that include this fix. Since this is not a cloud service, remediation depends on deploying patched kernel versions. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the latest patch availability and deployment instructions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-cv75-hxcc-wfxg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40272"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d59c2644c7f847991b
Added to database: 07/30/2026, 15:50:45 UTC
Last enriched: 07/30/2026, 17:37:36 UTC
Last updated: 09/10/2026, 19:38:46 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.