# CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted

> A race condition in the Linux kernel's hugetlb subsystem can cause a kernel bug and denial of service when migrating folios during fallocate operations.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 20 Oct 2025
- **Updated:** 5 Aug 2026
- **Also known as:** BELL-CVE-2025-40006, DEBIAN-CVE-2025-40006, GHSA-3f8h-q5gp-rc64, ROOT-OS-DEBIAN-11-CVE-2025-40006, ROOT-OS-DEBIAN-12-CVE-2025-40006, ROOT-OS-DEBIAN-13-CVE-2025-40006, ROOT-OS-UBUNTU-2404-CVE-2025-40006, UBUNTU-CVE-2025-40006

## What is CVE-2025-40006?

CVE-2025-40006 is a high-severity vulnerability in Linux, published on 20 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix folio is still mapped when deleted

Migration may be raced with fallocating hole.  remove_inode_single_folio
will unmap the folio if the folio is still mapped.  However, it's called
without folio lock.  If the folio is migrated and the mapped pte has been
converted to migration entry, folio_mapped() returns false, and won't
unmap it.  Due to extra refcount held by remove_inode_single_folio,
migration fails, restores migration entry to normal pte, and the folio is
mapped again.  As a result, we triggered BUG in filemap_unaccount_folio.

The log is as follows:
 BUG: Bad page cache in process hugetlb  pfn:156c00
 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00
 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0
 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"
 flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)
 page_type: f4(hugetlb)
 page dumped because: still mapped when deleted
 CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE
 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
 Call Trace:
  <TASK>
  dump_stack_lvl+0x4f/0x70
  filemap_unaccount_folio+0xc4/0x1c0
  __filemap_remove_folio+0x38/0x1c0
  filemap_remove_folio+0x41/0xd0
  remove_inode_hugepages+0x142/0x250
  hugetlbfs_fallocate+0x471/0x5a0
  vfs_fallocate+0x149/0x380

Hold folio lock before checking if the folio is mapped to avold race with
migration.

## Which versions are affected by CVE-2025-40006?


## How do I fix CVE-2025-40006?

Apply the vendor's patch.

## Is CVE-2025-40006 being exploited?

There is no known exploitation of CVE-2025-40006 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-40006 and fix it if it is affected.

What it is: CVE-2025-40006 is a high-severity vulnerability in Linux, published on 20 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-40006 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-40006/ (Markdown: https://insights.sbomify.com/CVE-2025-40006/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-40006
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40006
- OSV: https://osv.dev/vulnerability/CVE-2025-40006

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-40006/
Summaries are generated and may contain mistakes; the official description above is the record.