CVE-2025-22090 — x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()

Affected: Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()

If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables.

Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied.

The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about "simply" clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong.

So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation.

Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this proc…

USN-7594-1 — linux, linux-gcp, linux-raspi, linux-realtime vulnerabilities

Affected: Ubuntu:25.04: linux, Ubuntu:25.04: linux-gcp, Ubuntu:25.04: linux-raspi, Ubuntu:25.04: linux-realtime

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - Drivers core; - Ublk userspace block driver; - Bluetooth drivers; - Bus devices; - TPM device driver; - Clock framework and drivers; - CPU frequency scaling framework; - Buffer Sharing and Synchronization framework; - DMA engine subsystem; - GPU drivers; - HID subsystem; - HSI subsystem; - I2C subsystem; - I3C subsystem; - IIO subsystem; - InfiniBand drivers; - IOMMU subsystem; - IRQ chip drivers; - MCB driver; - Multiple devices driver; - Media drivers; - MemoryStick subsystem; - Multifunction device drivers; - Microchip PCI driver; - Intel Management Engine Interface driver; - PCI Endpoint Test driver; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - STMicroelectronics network drivers; - NTB driver; - NVME drivers; - PCI subsystem; - Synopsys DesignWare PCIe PMU; - Mellanox platform drivers; - PWM drivers; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; -…

Most recent entries from all

CVE-2025-22090 — x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()

USN-7594-1 — linux, linux-gcp, linux-raspi, linux-realtime vulnerabilities