CVE-2025-40199 page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
A flaw in the Linux kernel page_pool implementation causes system crashes on some 32-bit architectures due to incorrect magic mask handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40199?
CVE-2025-40199 is a high-severity vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the page_pool_page_is_pp() incurs false positives which crashes the machine.
Just disabling the check in page_pool_is_pp() will lead to the page_pool code itself malfunctioning; so instead of doing this, this patch changes the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel pointers for page_pool-tagged pages.
The fix relies on the kernel pointers that alias with the pp_magic field always being above PAGE_OFFSET. With this assumption, we can use the lowest bit of the value of PAGE_OFFSET as the upper bound of the PP_DMA_INDEX_MASK, which should avoid the false positives.
Because we cannot rely on PAGE_OFFSET always being a compile-time constant, nor on it always being >0, we fall back to disabling the dma_index storage when there are not enough bits available. This leaves us in the situation we were in before the patch in the Fixes tag, but only on a subset of architecture configurations. This seems to be the best we can do until the transition to page types in complete for page_pool pages.
v2: - Make sure there's at least 8 bits available and that the PAGE_OFFSET bit calculation doesn't wrap
Which versions are affected by CVE-2025-40199?
How do I fix CVE-2025-40199?
Apply the vendor's patch.
Is CVE-2025-40199 being exploited?
There is no known exploitation of CVE-2025-40199 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40199, DEBIAN-CVE-2025-40199, GHSA-79fg-r6v6-prp7, ROOT-OS-DEBIAN-13-CVE-2025-40199, UBUNTU-CVE-2025-40199.