Bug 2422797 (CVE-2025-68293) - CVE-2025-68293 kernel: mm/huge_memory: fix NULL pointer deference when splitting folio
Summary: CVE-2025-68293 kernel: mm/huge_memory: fix NULL pointer deference when splitt...
Keywords:
Status: NEW
Alias: CVE-2025-68293
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-16 16:02 UTC by OSIDB Bzimport
Modified: 2025-12-18 13:03 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-12-16 16:02:24 UTC
In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix NULL pointer deference when splitting folio

Commit c010d47f107f ("mm: thp: split huge page to any lower order pages")
introduced an early check on the folio's order via mapping->flags before
proceeding with the split work.

This check introduced a bug: for shmem folios in the swap cache and
truncated folios, the mapping pointer can be NULL.  Accessing
mapping->flags in this state leads directly to a NULL pointer dereference.

This commit fixes the issue by moving the check for mapping != NULL before
any attempt to access mapping->flags.


Note You need to log in before you can comment on or make changes to this bug.