# CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

> A local attacker can cause excessive CPU usage in the KSM daemon by creating sparse memory mappings, leading to a denial of service.

- **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 16 Dec 2025
- **Updated:** 11 Jun 2026
- **Also known as:** AZL-72419, AZL-78398, BELL-CVE-2025-68211, DEBIAN-CVE-2025-68211, GHSA-qhqr-mc3h-hmjp, ROOT-OS-DEBIAN-11-CVE-2025-68211, ROOT-OS-DEBIAN-12-CVE-2025-68211, ROOT-OS-DEBIAN-13-CVE-2025-68211, ROOT-OS-UBUNTU-2204-CVE-2025-68211, ROOT-OS-UBUNTU-2404-CVE-2025-68211, UBUNTU-CVE-2025-68211

## What is CVE-2025-68211?

CVE-2025-68211 is a medium-severity denial of service vulnerability in Linux kernel, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

Currently, scan_get_next_rmap_item() walks every page address in a VMA to
locate mergeable pages.  This becomes highly inefficient when scanning
large virtual memory areas that contain mostly unmapped regions, causing
ksmd to use large amount of cpu without deduplicating much pages.

This patch replaces the per-address lookup with a range walk using
walk_page_range().  The range walker allows KSM to skip over entire
unmapped holes in a VMA, avoiding unnecessary lookups.  This problem was
previously discussed in [1].

Consider the following test program which creates a 32 TiB mapping in the
virtual address space but only populates a single page:

#include <unistd.h>
#include <stdio.h>
#include <sys/mman.h>

/* 32 TiB */
const size_t size = 32ul * 1024 * 1024 * 1024 * 1024;

int main() {
        char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,
                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);

        if (area == MAP_FAILED) {
                perror("mmap() failed\n");
                return -1;
        }

        /* Populate a single page such that we get an anon_vma. */
        *area = 0;

        /* Enable KSM. */
        madvise(area, size, MADV_MERGEABLE);
        pause();
        return 0;
}

$ ./ksm-sparse  &
$ echo 1 > /sys/kernel/mm/ksm/run 

Without this patch ksmd uses 100% of the cpu for a long time (more then 1
hour in my test machine) scanning all the 32 TiB virtual address space
that contain only one mapped page.  This makes ksmd essentially deadlocked
not able to deduplicate anything of value.  With this patch ksmd walks
only the one mapped page and skips the rest of the 32 TiB virtual address
space, making the scan fast using little cpu.

## Which versions are affected by CVE-2025-68211?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2025-68211?

Apply the vendor's patch.

## Is CVE-2025-68211 being exploited?

There is no known exploitation of CVE-2025-68211 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-68211 and fix it if it is affected.

What it is: CVE-2025-68211 is a medium-severity denial of service vulnerability in Linux kernel, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-68211 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-68211/ (Markdown: https://insights.sbomify.com/CVE-2025-68211/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68211
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-68211
- OSV: https://osv.dev/vulnerability/CVE-2025-68211

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-68211/
Summaries are generated and may contain mistakes; the official description above is the record.