CVE-2025-37818 LoongArch: Return NULL from huge_pte_offset() for invalid PMD
A local attacker can cause a kernel crash on LoongArch systems by triggering a null pointer dereference in the huge page table handling code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37818?
CVE-2025-37818 is a medium-severity vulnerability in Debian Debian Linux, published on 8 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Return NULL from huge_pte_offset() for invalid PMD
LoongArch's huge_pte_offset() currently returns a pointer to a PMD slot even if the underlying entry points to invalid_pte_table (indicating no mapping). Callers like smaps_hugetlb_range() fetch this invalid entry value (the address of invalid_pte_table) via this pointer.
The generic is_swap_pte() check then incorrectly identifies this address as a swap entry on LoongArch, because it satisfies the "!pte_present() && !pte_none()" conditions. This misinterpretation, combined with a coincidental match by is_migration_entry() on the address bits, leads to kernel crashes in pfn_swap_entry_to_page().
Fix this at the architecture level by modifying huge_pte_offset() to check the PMD entry's content using pmd_none() before returning. If the entry is invalid (i.e., it points to invalid_pte_table), return NULL instead of the pointer to the slot.
Weakness: CWE-476
Which versions are affected by CVE-2025-37818?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-37818?
Apply the vendor's patch.
Is CVE-2025-37818 being exploited?
There is no known exploitation of CVE-2025-37818 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-37818, DEBIAN-CVE-2025-37818, GHSA-4q4q-jv3m-fqjr, ROOT-OS-DEBIAN-12-CVE-2025-37818, ROOT-OS-UBUNTU-2204-CVE-2025-37818, UBUNTU-CVE-2025-37818.