{
  "cveId": "CVE-2025-39776",
  "url": "https://patchblox.com/security/cve/CVE-2025-39776",
  "summary": "CVE-2025-39776 is fixed in linux on 1 platform, first by DEBIAN-CVE-2025-39776, released September 11, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "mm/debug_vm_pgtable: clear page table entries at destroy_args()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  mm/debug_vm_pgtable: clear page table entries at destroy_args()  The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct.  That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions.  The problem is that leaves stale entries.  If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry.  This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function):  [    2.539353] debug_vm_pgtable: [get_random_vaddr         ]: random_vaddr is 0x7ea247140000 [    2.539366] kmem_cache info [    2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [    2.539447] debug_vm_pgtable: [init_args                ]: args-\u003Emm is 0x000000002267cc9e (...) [    2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range\u002B0x8bc/0x8d0 [    2.552816] Modules linked in: [    2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le\u002Bdebug #1 VOLUNTARY [    2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [    2.552872] NIP:  c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [    2.552885] REGS: c0000000622e73b0 TRAP: 0700   Not tainted  (6.12.0-105.debug_vm2.el10.ppc64le\u002Bdebug) [    2.552899] MSR:  800000000282b033 \u003CSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003E  CR: 24002822  XER: 0000000a [    2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [    2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [    2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [    2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [    2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [    2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [    2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [    2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [    2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [    2.553170] NIP [c0000000007eef3c] free_pud_range\u002B0x8bc/0x8d0 [    2.553185] LR [c0000000007eef30] free_pud_range\u002B0x8b0/0x8d0 [    2.553199] Call Trace: [    2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range\u002B0x8b0/0x8d0 (unreliable) [    2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range\u002B0x284/0x3b0 [    2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables\u002B0x450/0x570 [    2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap\u002B0x250/0x650 [    2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput\u002B0x98/0x290 [    2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm\u002B0x118/0x1b0 [    2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit\u002B0x2ec/0x870 [    2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit\u002B0x88/0x150 [    2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group\u002B0x48/0x50 [    2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception\u002B0x1e0/0x4c0 [    2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common\u002B0x15c/0x2ec (...) [    2.558892] ---[ end trace 0000000000000000 ]--- [    2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [    2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144  Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test.  That is not a problem, since the mm_stru ---truncated---",
  "published": "2025-09-11T17:15:43Z",
  "severity": "Moderate",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00151,
  "epssPercentile": 0.04247,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-39776",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.153-1",
      "fix": "DEBIAN-CVE-2025-39776",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-39776",
      "released": "2025-09-11T17:15:43Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.48-1",
      "fix": "DEBIAN-CVE-2025-39776",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-39776",
      "released": "2025-09-11T17:15:43Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.16.5-1",
      "fix": "DEBIAN-CVE-2025-39776",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-39776",
      "released": "2025-09-11T17:15:43Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}