CVE-2025-40353 arm64: mte: Do not warn if the page is already tagged in copy_highpage()
A kernel bug causes unnecessary warnings during memory migration, potentially leading to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40353?
CVE-2025-40353 is a denial of service vulnerability in Linux, published on 16 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm64: mte: Do not warn if the page is already tagged in copy_highpage()
The arm64 copy_highpage() assumes that the destination page is newly allocated and not MTE-tagged (PG_mte_tagged unset) and warns accordingly. However, following commit 060913999d7a ("mm: migrate: support poisoned recover from migrate folio"), folio_mc_copy() is called before __folio_migrate_mapping(). If the latter fails (-EAGAIN), the copy will be done again to the same destination page. Since copy_highpage() already set the PG_mte_tagged flag, this second copy will warn.
Replace the WARN_ON_ONCE(page already tagged) in the arm64 copy_highpage() with a comment.
Which versions are affected by CVE-2025-40353?
How do I fix CVE-2025-40353?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40353 being exploited?
There is no known exploitation of CVE-2025-40353 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40353, DEBIAN-CVE-2025-40353, GHSA-27p4-p9vc-8f94, ROOT-OS-UBUNTU-2204-CVE-2025-40353, ROOT-OS-UBUNTU-2404-CVE-2025-40353, UBUNTU-CVE-2025-40353.