Linux Kernel Soft Lockup Vulnerability in Hugetlb Memory Management

CVE-2025-40153

What is CVE-2025-40153?

A soft lockup was observed in the Linux kernel when using the 'mprotect()' function with large hugetlb memory areas, specifically around 300GB. This issue was indicated by a CPU getting stuck for an extended period, affecting system performance. The root of the problem was identified in the handling of large memory areas without appropriate scheduling, which could lead to prolonged processing times and unresponsive states. Improvements in the kernel have since added checks to mitigate this risk by incorporating scheduling points during memory protection adjustments for hugetlb, ensuring smoother operation and reducing the likelihood of system hang-ups.

References