CVE-2025-22015

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate: fix shmem xarray update during migration

A shmem folio can be either in page cache or in swap cache, but not at the

same time. Namely, once it is in swap cache, folio->mapping should be

NULL, and the folio is no longer in a shmem mapping.

In __folio_migrate_mapping(), to determine the number of xarray entries to

update, folio_test_swapbacked() is used, but that conflates shmem in page

cache case and shmem in swap cache case. It leads to xarray multi-index

entry corruption, since it turns a sibling entry to a normal entry during

xas_store() (see [1] for a userspace reproduction). Fix it by only using

folio_test_swapcache() to determine whether xarray is storing swap cache

entries or not to choose the right number of xarray entries to update.

[1] https://lore.kernel.org/linux-mm/[email protected]/

Note:

In __split_huge_page(), folio_test_anon() && folio_test_swapcache() is

used to

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References