Kernel Bug in Linux Kernel Affecting Memory Access Validation

CVE-2025-40009

What is CVE-2025-40009?

A vulnerability in the Linux kernel arises from improper validation of memory access during the execution of the PAGEMAP_SCAN ioctl when vec_len is set to zero, leading to a potential kernel panic due to a deference of a NULL pointer in the pagemap_scan_backout_range function. This flaw can disrupt the expected behavior of the system, potentially allowing for instability or unresponsive states. A fix is implemented to check for NULL before dereferencing p->vec_buf, ensuring better memory validation and system reliability. This issue was identified by syzkaller.

References