# CVE-2025-68231: mm/mempool: fix poisoning order>0 pages with HIGHMEM

> A kernel bug causes a page fault and system crash when poisoning high-order pages with HIGHMEM enabled, leading to denial of service.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Not stated
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 16 Dec 2025
- **Updated:** 11 May 2026
- **Also known as:** AZL-72458, BELL-CVE-2025-68231, DEBIAN-CVE-2025-68231, GHSA-rgc8-7q99-mqx9, ROOT-OS-DEBIAN-11-CVE-2025-68231, ROOT-OS-DEBIAN-12-CVE-2025-68231, ROOT-OS-DEBIAN-13-CVE-2025-68231, ROOT-OS-UBUNTU-2204-CVE-2025-68231, ROOT-OS-UBUNTU-2404-CVE-2025-68231, UBUNTU-CVE-2025-68231

## What is CVE-2025-68231?

CVE-2025-68231 is a memory corruption vulnerability in Linux, published on 16 Dec 2025. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

mm/mempool: fix poisoning order>0 pages with HIGHMEM

The kernel test has reported:

  BUG: unable to handle page fault for address: fffba000
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  *pde = 03171067 *pte = 00000000
  Oops: Oops: 0002 [#1]
  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE  a1d066dfe789f54bc7645c7989957d2bdee593ca
  Tainted: [T]=RANDSTRUCT
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)
  Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56
  EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b
  ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8
  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287
  CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690
  Call Trace:
   poison_element (mm/mempool.c:83 mm/mempool.c:102)
   mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)
   mempool_init_noprof (mm/mempool.c:250 (discriminator 1))
   ? mempool_alloc_pages (mm/mempool.c:640)
   bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))
   ? mempool_alloc_pages (mm/mempool.c:640)
   do_one_initcall (init/main.c:1283)

Christoph found out this is due to the poisoning code not dealing
properly with CONFIG_HIGHMEM because only the first page is mapped but
then the whole potentially high-order page is accessed.

We could give up on HIGHMEM here, but it's straightforward to fix this
with a loop that's mapping, poisoning or checking and unmapping
individual pages.

## Which versions are affected by CVE-2025-68231?


## How do I fix CVE-2025-68231?

Apply the vendor's patch.

## Is CVE-2025-68231 being exploited?

There is no known exploitation of CVE-2025-68231 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-68231 and fix it if it is affected.

What it is: CVE-2025-68231 is a memory corruption vulnerability in Linux, published on 16 Dec 2025. 
Exploitation: There is no known exploitation of CVE-2025-68231 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-68231/ (Markdown: https://insights.sbomify.com/CVE-2025-68231/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68231
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-68231
- OSV: https://osv.dev/vulnerability/CVE-2025-68231

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-68231/
Summaries are generated and may contain mistakes; the official description above is the record.