CVE-2025-40199

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches

Helge reported that the introduction of PP_MAGIC_MASK let to crashes on

boot on his 32-bit parisc machine. The cause of this is the mask is set

too wide, so the page_pool_page_is_pp() incurs false positives which

crashes the machine.

Just disabling the check in page_pool_is_pp() will lead to the page_pool

code itself malfunctioning; so instead of doing this, this patch changes

the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel

pointers for page_pool-tagged pages.

The fix relies on the kernel pointers that alias with the pp_magic field

always being above PAGE_OFFSET. With this assumption, we can use the

lowest bit of the value of PAGE_OFFSET as the upper bound of the

PP_DMA_INDEX_MASK, which should avoid the false positives.

Because we cannot rely on PAGE_OFFSET always being a compile-time

constant, nor on it always being >0, we

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References