Bug 2357137 (CVE-2025-22000) - CVE-2025-22000 kernel: mm/huge_memory: drop beyond-EOF folios with the right number of refs
Summary: CVE-2025-22000 kernel: mm/huge_memory: drop beyond-EOF folios with the right ...
Keywords:
Status: NEW
Alias: CVE-2025-22000
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-03 08:01 UTC by OSIDB Bzimport
Modified: 2025-04-09 10:47 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-03 08:01:34 UTC
In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: drop beyond-EOF folios with the right number of refs

When an after-split folio is large and needs to be dropped due to EOF,
folio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all
page cache refs.  Otherwise, the folio will not be freed, causing memory
leak.

This leak would happen on a filesystem with blocksize > page_size and a
truncate is performed, where the blocksize makes folios split to >0 order
ones, causing truncated folios not being freed.

Comment 1 Avinash Hanwate 2025-04-03 09:35:57 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025040349-CVE-2025-22000-50c3@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.