CVE-2025-22090

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()

If track_pfn_copy() fails, we already added the dst VMA to the maple

tree. As fork() fails, we'll cleanup the maple tree, and stumble over

the dst VMA for which we neither performed any reservation nor copied

any page tables.

Consequently untrack_pfn() will see VM_PAT and try obtaining the

PAT information from the page table -- which fails because the page

table was not copied.

The easiest fix would be to simply clear the VM_PAT flag of the dst VMA

if track_pfn_copy() fails. However, the whole thing is about "simply"

clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()

and performed a reservation, but copying the page tables fails, we'll

simply clear the VM_PAT flag, not properly undoing the reservation ...

which is also wrong.

So let's fix it properly: set the VM_PAT flag only if the reservation

succeeded (leaving it clear

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References