CVE-2025-39700— mm/damon/ops-common: ignore migration request to invalid nodes
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-39700
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mm/damon/ops-common: ignore migration request to invalid nodes
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() tries migration even if the target node is invalid. If users mistakenly make such invalid requests via DAMOS_MIGRATE_{HOT,COLD} action, the below kernel BUG can happen. [ 7831.883495] BUG: unable to handle page fault for address: 0000000000001f48 [ 7831.884160] #PF: supervisor read access in kernel mode [ 7831.884681] #PF: error_code(0x0000) - not-present page [ 7831.885203] PGD 0 P4D 0 [ 7831.885468] Oops: Oops: 0000 [#1] SMP PTI [ 7831.885852] CPU: 31 UID: 0 PID: 94202 Comm: kdamond.0 Not tainted 6.16.0-rc5-mm-new-damon+ #93 PREEMPT(voluntary) [ 7831.886913] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.el9 04/01/2014 [ 7831.887777] RIP: 0010:__alloc_frozen_pages_noprof (include/linux/mmzone.h:1724 include/linux/mmzone.h:1750 mm/page_alloc.c:4936 mm/page_alloc.c:5137) [...] [ 7831.895953] Call Trace: [ 7831.896195] <TASK> [ 7831.896397] __folio_alloc_noprof (mm/page_alloc.c:5183 mm/page_alloc.c:5192) [ 7831.896787] migrate_pages_batch (mm/migrate.c:1189 mm/migrate.c:1851) [ 7831.897228] ? __pfx_alloc_migration_target (mm/migrate.c:2137) [ 7831.897735] migrate_pages (mm/migrate.c:2078) [ 7831.898141] ? __pfx_alloc_migration_target (mm/migrate.c:2137) [ 7831.898664] damon_migrate_folio_list (mm/damon/ops-common.c:321 mm/damon/ops-common.c:354) [ 7831.899140] damon_migrate_pages (mm/damon/ops-common.c:405) [...] Add a target node validity check in damon_migrate_pages(). The validity check is stolen from that of do_pages_move(), which is being used for the move_pages() system call.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mm/damon/ops-common模块未忽略无效节点的迁移请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39700
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39700
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-05 · 60 CVEs total
| CVE-2025-39707 | drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities | |
| CVE-2025-39725 | mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list | |
| CVE-2025-39722 | crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP | |
| CVE-2025-39721 | crypto: qat - flush misc workqueue during device shutdown | |
| CVE-2025-39720 | ksmbd: fix refcount leak causing resource not released | |
| CVE-2025-39723 | netfs: Fix unbuffered write error handling | |
| CVE-2025-39711 | media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls | |
| CVE-2025-39710 | media: venus: Add a check for packet size after reading from shared memory | |
| CVE-2025-39709 | media: venus: protect against spurious interrupts during probe | |
| CVE-2025-39708 | media: iris: Fix NULL pointer dereference | |
| CVE-2025-39712 | media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval | |
| CVE-2025-39706 | drm/amdkfd: Destroy KFD debugfs after destroy KFD wq | |
| CVE-2025-39705 | drm/amd/display: fix a Null pointer dereference vulnerability | |
| CVE-2025-39704 | LoongArch: KVM: Fix stack protector issue in send_ipi_data() | |
| CVE-2025-39703 | net, hsr: reject HSR frame if skb can't hold tag | |
| CVE-2025-39702 | ipv6: sr: Fix MAC comparison to be constant-time | |
| CVE-2025-39701 | ACPI: pfr_update: Fix the driver update version check | |
| CVE-2025-39699 | iommu/riscv: prevent NULL deref in iova_to_phys | |
| CVE-2025-39698 | io_uring/futex: ensure io_futex_wait() cleans up properly on failure | |
| CVE-2025-39697 | NFS: Fix a race when updating an existing write |
Showing top 20 of 60 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2025-39700
No comments yet