{"id":"DEBIAN-CVE-2025-38102","details":"In the Linux kernel, the following vulnerability has been resolved:  VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify  During our test, it is found that a warning can be trigger in try_grab_folio as follow:    ------------[ cut here ]------------   WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130   Modules linked in:   CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef)   RIP: 0010:try_grab_folio+0x106/0x130   Call Trace:    \u003cTASK\u003e    follow_huge_pmd+0x240/0x8e0    follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0    follow_pud_mask.constprop.0.isra.0+0x14a/0x170    follow_page_mask+0x1c2/0x1f0    __get_user_pages+0x176/0x950    __gup_longterm_locked+0x15b/0x1060    ? gup_fast+0x120/0x1f0    gup_fast_fallback+0x17e/0x230    get_user_pages_fast+0x5f/0x80    vmci_host_unlocked_ioctl+0x21c/0xf80   RIP: 0033:0x54d2cd   ---[ end trace 0000000000000000 ]---  Digging into the source, context-\u003enotify_page may init by get_user_pages_fast and can be seen in vmci_ctx_unset_notify which will try to put_page. However get_user_pages_fast is not finished here and lead to following try_grab_folio warning. The race condition is shown as follow:  cpu0\t\t\tcpu1 vmci_host_do_set_notify vmci_host_setup_notify get_user_pages_fast(uva, 1, FOLL_WRITE, &context-\u003enotify_page); lockless_pages_from_mm gup_pgd_range gup_huge_pmd  // update &context-\u003enotify_page \t\t\tvmci_host_do_set_notify \t\t\tvmci_ctx_unset_notify \t\t\tnotify_page = context-\u003enotify_page; \t\t\tif (notify_page) \t\t\tput_page(notify_page);\t// page is freed __gup_longterm_locked __get_user_pages follow_trans_huge_pmd try_grab_folio // warn here  To slove this, use local variable page to make notify_page can be seen after finish get_user_pages_fast.","modified":"2026-09-01T16:06:13.783678639Z","published":"2025-07-03T09:15:23.710Z","upstream":["CVE-2025-38102"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38102"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.147-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38102.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38102.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38102.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}