# CVE-2025-40199: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches

> A flaw in the Linux kernel page_pool implementation causes system crashes on some 32-bit architectures due to incorrect magic mask handling.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 12 Nov 2025
- **Updated:** 15 Oct 2026
- **Also known as:** BELL-CVE-2025-40199, DEBIAN-CVE-2025-40199, GHSA-79fg-r6v6-prp7, ROOT-OS-DEBIAN-13-CVE-2025-40199, UBUNTU-CVE-2025-40199

## What is CVE-2025-40199?

CVE-2025-40199 is a high-severity vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches

Helge reported that the introduction of PP_MAGIC_MASK let to crashes on
boot on his 32-bit parisc machine. The cause of this is the mask is set
too wide, so the page_pool_page_is_pp() incurs false positives which
crashes the machine.

Just disabling the check in page_pool_is_pp() will lead to the page_pool
code itself malfunctioning; so instead of doing this, this patch changes
the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel
pointers for page_pool-tagged pages.

The fix relies on the kernel pointers that alias with the pp_magic field
always being above PAGE_OFFSET. With this assumption, we can use the
lowest bit of the value of PAGE_OFFSET as the upper bound of the
PP_DMA_INDEX_MASK, which should avoid the false positives.

Because we cannot rely on PAGE_OFFSET always being a compile-time
constant, nor on it always being >0, we fall back to disabling the
dma_index storage when there are not enough bits available. This leaves
us in the situation we were in before the patch in the Fixes tag, but
only on a subset of architecture configurations. This seems to be the
best we can do until the transition to page types in complete for
page_pool pages.

v2:
- Make sure there's at least 8 bits available and that the PAGE_OFFSET
  bit calculation doesn't wrap

## Which versions are affected by CVE-2025-40199?


## How do I fix CVE-2025-40199?

Apply the vendor's patch.

## Is CVE-2025-40199 being exploited?

There is no known exploitation of CVE-2025-40199 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-40199 and fix it if it is affected.

What it is: CVE-2025-40199 is a high-severity vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-40199 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-40199/ (Markdown: https://insights.sbomify.com/CVE-2025-40199/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-40199
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40199
- OSV: https://osv.dev/vulnerability/CVE-2025-40199

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-40199/
Summaries are generated and may contain mistakes; the official description above is the record.