CVE-2025-38686 userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
A local attacker can cause a kernel crash by triggering a null dereference in the userfaultfd subsystem during page migration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38686?
CVE-2025-38686 is a medium-severity vulnerability in Linux kernel, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swp_entry_t. Add the missing check and let split_huge_pmd() handle migration entries. While at it also remove unnecessary folio check.
[surenb@google.com: remove extra folio check, per David]
Which versions are affected by CVE-2025-38686?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38686?
Apply the vendor's patch.
Is CVE-2025-38686 being exploited?
There is no known exploitation of CVE-2025-38686 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38686, DEBIAN-CVE-2025-38686, GHSA-vwc5-3f53-7rhp, ROOT-OS-UBUNTU-2404-CVE-2025-38686, UBUNTU-CVE-2025-38686.