CVE-2025-40040

A flaw was found in the Linux kernel’s KSM (Kernel Same-page Merging) subsystem during ksm_madvise() operations: when a madvise(MADV_UNMERGEABLE) call is made on a VMA registered for userfaultfd (UFFD) in MINOR mode, the code clears the VM_MERGEABLE flag incorrectly. The constant VM_MERGEABLE is defined as a 32-bit unsigned int, and when negated and promoted to unsigned long, the upper 32 bits are cleared unexpectedly. This leads to an inconsistent VMA state (e.g., a valid vm_userfaultfd_ctx pointer but missing UFFD flags), which under certain conditions causes kernel panics or warnings during userfaultfd_release_all().

This vulnerability is rated as Moderate because triggering the issue requires local access to execute specific memory advisory and userfaultfd system calls, limiting the risk primarily to a local denial of service. When an application attempts to mark registered memory ranges as unmergeable, improper type conversion inside the kernel memory management subsystem inadvertently strips high-order virtual memory flags. This flag corruption results in an inconsistent internal kernel state that can induce a kernel panic or trigger warnings during resource cleanup. Because exploitation cannot be achieved remotely and does not directly permit privilege escalation or information disclosure, the overall severity is kept at Moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.