CVE-2025-39883: Linux Kernel Use-After-Free Vulnerability

CVE-2025-39883 Overview

CVE-2025-39883 is a Linux kernel vulnerability in the mm/memory-failure subsystem. The flaw resides in the unpoison_memory() function, which fails to validate whether a target page frame number (PFN) belongs to an online memory zone before checking the PG_HWPoison flag. When a local user writes an offlined PFN to /sys/kernel/debug/hwpoison/unpoison-pfn, the kernel triggers VM_BUG_ON_PAGE(PagePoisoned(page)) and panics. The bug is classified as an out-of-bounds read [CWE-125] because the code accesses metadata for an uninitialized struct page. Affected products include the mainline Linux kernel and Debian Linux 11.

Critical Impact
A local user with privileges to write to the hwpoison debugfs interface can trigger a kernel panic, causing a full system denial of service.

Affected Products

Linux Kernel (multiple stable branches, including 6.17-rc1 through 6.17-rc5)
Debian Linux 11.0
Systems exposing /sys/kernel/debug/hwpoison/ to privileged users

Discovery Timeline

2025-09-23 - CVE-2025-39883 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39883

Vulnerability Analysis

The vulnerability lives in the unpoison_memory() code path in mm/memory-failure.c. When user space writes a PFN to the unpoison-pfn debugfs attribute, the kernel converts the PFN to a struct page pointer and reads the page flags to determine hardware-poison state. The function does not verify that the PFN maps to an online memory section. If the corresponding memory block has been offlined via /sys/devices/system/memory/memoryN/state, the struct page remains uninitialized. Reading PG_HWPoison on an uninitialized page trips the VM_BUG_ON_PAGE(PagePoisoned(page)) assertion at include/linux/page-flags.h:616, which invokes BUG() and produces a fatal kernel oops with the invalid opcode fault visible in the reported stack trace at unpoison_memory+0x2f3/0x590.

Root Cause

The root cause is missing validation of memory-section state before dereferencing page metadata. The fix uses pfn_to_online_page() to confirm the PFN belongs to an online section and rejects ZONE_DEVICE pages. When pfn_to_online_page() returns NULL, unpoison_memory() now fails early instead of continuing into flag inspection on an uninitialized struct page.

Attack Vector

Exploitation requires local access and privileges sufficient to write to the hwpoison debugfs interface, typically root or a user with CAP_SYS_ADMIN. The reproduction sequence is: offline a memory block by writing offline to its sysfs state, obtain the offlined PFN via page-types -b n -rlN, then write that PFN to /sys/kernel/debug/hwpoison/unpoison-pfn. The write triggers the assertion and panics the kernel. The vulnerability does not enable code execution or data disclosure; the practical impact is denial of service through forced host reboot. See the Debian LTS Security Announcement for distribution-specific details.

Detection Methods for CVE-2025-39883

Indicators of Compromise

Kernel panic messages referencing VM_BUG_ON_PAGE(PagePoisoned(page)) and unpoison_memory+0x2f3/0x590 in dmesg or serial console logs.
Unexpected system reboots correlated with writes to /sys/kernel/debug/hwpoison/unpoison-pfn.
Preceding activity that offlines memory blocks via /sys/devices/system/memory/memoryN/state.

Detection Strategies

Monitor audit logs for writes to /sys/kernel/debug/hwpoison/unpoison-pfn and /sys/devices/system/memory/*/state using auditd rules on the paths.
Correlate crash dumps and kdump output for the unpoison_memory symbol in the panic backtrace.
Track loading of the hwpoison_inject module, which is required to exercise the code path in most distribution kernels.

Monitoring Recommendations

Alert on kernel oops or panic events shipped from /var/log/kern.log, journalctl -k, or centralized log collection.
Baseline which accounts and processes legitimately interact with hwpoison debugfs entries and flag deviations.
Watch for repeated memory offline operations followed by hwpoison writes on the same host.

How to Mitigate CVE-2025-39883

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the vendor advisories and reboot affected systems.
Restrict access to /sys/kernel/debug by mounting debugfs with restrictive permissions or not mounting it in production.
Blocklist the hwpoison_inject module on production hosts that do not require memory-failure testing.

Patch Information

The fix is committed across multiple stable branches. Relevant commits include 3d278e89c2ea, 63a327a2375a, 7618fd443aa4, 8e01ea186a52, 99f7048957f5, d613f53c83ec, e4ec6def5643, and fb65803ccff3. Debian 11 users should follow the Debian LTS Security Announcement for package updates.

Workarounds

Remount debugfs with mode=0700 and restrict it to root, or unmount it entirely where feasible.
Add install hwpoison_inject /bin/false to /etc/modprobe.d/ to block the injection module.
Limit CAP_SYS_ADMIN and root shell access on multi-tenant hosts until patched kernels are deployed.

bash

# Restrict debugfs access and block hwpoison_inject module
mount -o remount,mode=700 /sys/kernel/debug
echo "install hwpoison_inject /bin/false" > /etc/modprobe.d/blacklist-hwpoison.conf