{"id":"DEBIAN-CVE-2025-40009","details":"In the Linux kernel, the following vulnerability has been resolved:  fs/proc/task_mmu: check p-\u003evec_buf for NULL  When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches pagemap_scan_backout_range(), kernel panics with null-ptr-deref:  [   44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [   44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [   44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none) [   44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [   44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80  \u003csnip registers, unreliable trace\u003e  [   44.946828] Call Trace: [   44.947030]  \u003cTASK\u003e [   44.949219]  pagemap_scan_pmd_entry+0xec/0xfa0 [   44.952593]  walk_pmd_range.isra.0+0x302/0x910 [   44.954069]  walk_pud_range.isra.0+0x419/0x790 [   44.954427]  walk_p4d_range+0x41e/0x620 [   44.954743]  walk_pgd_range+0x31e/0x630 [   44.955057]  __walk_page_range+0x160/0x670 [   44.956883]  walk_page_range_mm+0x408/0x980 [   44.958677]  walk_page_range+0x66/0x90 [   44.958984]  do_pagemap_scan+0x28d/0x9c0 [   44.961833]  do_pagemap_cmd+0x59/0x80 [   44.962484]  __x64_sys_ioctl+0x18d/0x210 [   44.962804]  do_syscall_64+0x5b/0x290 [   44.963111]  entry_SYSCALL_64_after_hwframe+0x76/0x7e  vec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are allocated and p-\u003evec_buf remains set to NULL.  This breaks an assumption made later in pagemap_scan_backout_range(), that page_region is always allocated for p-\u003evec_buf_index.  Fix it by explicitly checking p-\u003evec_buf for NULL before dereferencing.  Other sites that might run into same deref-issue are already (directly or transitively) protected by checking p-\u003evec_buf.  Note: From PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output is requested and it's only the side effects caller is interested in, hence it passes check in pagemap_scan_get_args().  This issue was found by syzkaller.","modified":"2026-08-27T22:48:38.368189004Z","published":"2025-10-20T16:15:37.593Z","upstream":["CVE-2025-40009"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-40009"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.57-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40009.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.10-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40009.json"}}],"schema_version":"1.9.0"}