CVE-2025-40199

A flaw was found in the page-pool subsystem of the Linux kernel (on certain 32-bit architectures). The macro PP_MAGIC_MASK was defined too broadly so that the function page_pool_page_is_pp() can mis-detect arbitrary kernel pointers as page-pool tagged pages. On affected systems, this can lead to boot-time crashes or denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local access and depends on specific 32-bit architecture memory configurations to trigger a denial of service. The flaw involves memory pointer verification within the core kernel page-pool allocator, where certain address ranges can be incorrectly flagged, leading to kernel panics. In supported Red Hat Enterprise Linux environments, which deploy 64-bit architectures, this memory address conflict is not encountered during standard operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.