PT-2025-42778 · Linux+3 · Linux Kernel+3

Published

2025-09-22

·

Updated

2026-05-07

·

CVE-2025-40009

CVSS v2.0

4.6

Medium

VectorAV:L/AC:L/Au:S/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc6
Description The Linux kernel contains a flaw within the fs/proc/task mmu component. Specifically, a null pointer dereference can occur in pagemap scan backout range() when the PAGEMAP SCAN ioctl is called with vec len set to 0. This condition leads to a kernel panic. The issue arises because p->vec buf remains NULL when vec len is 0, violating an assumption made during later processing. The fix involves explicitly checking p->vec buf for NULL before dereferencing it.
Recommendations Update to a version newer than 6.17.0-rc6.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-13575
CVE-2025-40009
OPENSUSE-SU-2025:20091-1
SUSE-SU-2025:21080-1
SUSE-SU-2025:21147-1
SUSE-SU-2025:21180-1
USN-8095-1
USN-8095-2
USN-8095-3
USN-8095-4
USN-8095-5
USN-8100-1
USN-8125-1
USN-8126-1
USN-8165-1
USN-8261-1

Affected Products

Linuxmint
Linux Kernel
Suse
Ubuntu