{"id":"CVE-2025-39845","revision":"26556d7bff20416ca43a9ce18750fccb","records":[{"revision":"26556d7bff20416ca43a9ce18750fccb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39845","aliases":[],"title":"x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()\n\nDefine ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure\npage tables are properly synchronized when calling p*d_populate_kernel().\n\nFor 5-level paging, synchronization is performed via\npgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so\nsynchronization is instead performed at the P4D level via\np4d_populate_kernel().\n\nThis fixes intermittent boot failures on systems using 4-level paging and\na large amount of persistent memory:\n\n BUG: unable to handle page fault for address: ffffe70000000034\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] SMP NOPTI\n RIP: 0010:__init_single_page+0x9/0x6d\n Call Trace:\n \n __init_zone_device_page+0x17/0x5d\n memmap_init_zone_device+0x154/0x1bb\n pagemap_range+0x2e0/0x40f\n memremap_pages+0x10b/0x2f0\n devm_memremap_pages+0x1e/0x60\n dev_dax_probe+0xce/0x2ec [device_dax]\n dax_bus_probe+0x6d/0xc9\n [... snip ...]\n \n\nIt also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap\nbefore sync_global_pgds() [1]:\n\n BUG: unable to handle page fault for address: ffffeb3ff1200000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI\n Tainted: [W]=WARN\n RIP: 0010:vmemmap_set_pmd+0xff/0x230\n \n vmemmap_populate_hugepages+0x176/0x180\n vmemmap_populate+0x34/0x80\n __populate_section_memmap+0x41/0x90\n sparse_add_section+0x121/0x3e0\n __add_pages+0xba/0x150\n add_pages+0x1d/0x70\n memremap_pages+0x3dc/0x810\n devm_memremap_pages+0x1c/0x60\n xe_devm_add+0x8b/0x100 [xe]\n xe_tile_init_noalloc+0x6a/0x70 [xe]\n xe_device_probe+0x48c/0x740 [xe]\n [... snip ...]","state":0,"publishedAt":"2025-09-19T15:26:19.225+00:00","modifiedAt":"2026-10-15T01:08:29.237+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"arch/x86/include/asm/pgtable_64_types.h\",\n \"arch/x86/mm/init_64.c\"\n ],\n \"versions\": [\n {\n \"version\": \"8d400913c231bd1da74067255816453f96cd35b0\",\n \"lessThan\": \"744ff519c72de31344a627eaf9b24e9595aae554\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8d400913c231bd1da74067255816453f96cd35b0\",\n \"lessThan\": \"5f761d40ee95d2624f839c90ebeef2d5c55007f5\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8d400913c231bd1da74067255816453f96cd35b0\",\n \"lessThan\": \"26ff568f390a531d1bd792e49f1a401849921960\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8d400913c231bd1da74067255816453f96cd35b0\",\n \"lessThan\": \"b7f4051dd3388edd30e9a6077c05c486aa31e0d4\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8d400913c231bd1da74067255816453f96cd35b0\",\n \"lessThan\": \"6bf9473727569e8283c1e2445c7ac42cf4fc9fa9\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8d400913c231bd1da74067255816453f96cd35b0\",\n \"lessThan\": \"6659d027998083fbb6d42a165b0c90dc2e8ba989\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"arch/x86/include/asm/pgtable_64_types.h\",\n \"arch/x86/mm/init_64.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.13\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.13\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.192\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.151\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.105\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.46\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.16.6\",\n \"lessThanOrEqual\": \"6.16.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.17\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/744ff519c72de31344a627eaf9b24e9595aae554","https://git.kernel.org/stable/c/5f761d40ee95d2624f839c90ebeef2d5c55007f5","https://git.kernel.org/stable/c/26ff568f390a531d1bd792e49f1a401849921960","https://git.kernel.org/stable/c/b7f4051dd3388edd30e9a6077c05c486aa31e0d4","https://git.kernel.org/stable/c/6bf9473727569e8283c1e2445c7ac42cf4fc9fa9","https://git.kernel.org/stable/c/6659d027998083fbb6d42a165b0c90dc2e8ba989"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39845","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39845","identifiers":["CVE-2025-39845"]},"retained":false,"historicalAffected":[]}],"coverage":[]}