CVE-2025-39845 – A memory management vulnerability in the Linux ... (How to Fix)

Q: What is the severity of CVE-2025-39845?

CVE-2025-39845 has a CVSS score of 5.5 (MEDIUM). A memory management vulnerability in the Linux kernel causes intermittent boot failures and crashes on systems with 4-level paging and large persistent memory. The issue occurs when page tables aren't properly synchronized during kernel memory mapping operations, leading to page faults and system instability. This affects Linux systems using 4-level paging with persistent memory devices.

📋 TL;DR

A memory management vulnerability in the Linux kernel causes intermittent boot failures and crashes on systems with 4-level paging and large persistent memory. The issue occurs when page tables aren't properly synchronized during kernel memory mapping operations, leading to page faults and system instability. This affects Linux systems using 4-level paging with persistent memory devices.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches available in stable kernel trees

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems with 4-level paging architecture and persistent memory devices. 5-level paging systems are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crashes during boot or when accessing persistent memory, causing denial of service and potential data corruption.

🟠

Likely Case

Intermittent boot failures or crashes when initializing persistent memory devices, leading to system instability.

🟢

If Mitigated

No impact if patched or if system doesn't use 4-level paging with persistent memory.

🌐 Internet-Facing: LOW - This is a local kernel memory management issue not directly exploitable over network.

🏢 Internal Only: MEDIUM - Affects system stability but requires specific hardware configuration to trigger.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering specific memory mapping operations on vulnerable hardware configuration. Not a traditional security exploit but a stability bug.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits: 26ff568f390a, 5f761d40ee95, 6659d0279980, 6bf947372756, 744ff519c72d)

Vendor Advisory: https://git.kernel.org/stable/c/26ff568f390a531d1bd792e49f1a401849921960

Restart Required: Yes

Instructions:

1. Update to patched kernel version from your distribution's repository. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable persistent memory devices

all

Temporarily disable or remove persistent memory devices to avoid triggering the bug

🧯 If You Can't Patch

Avoid using persistent memory devices on affected systems
Monitor system logs for page fault errors and be prepared for potential crashes

🔍 How to Verify

Check if Vulnerable:

Check if system uses 4-level paging and has persistent memory devices. Monitor for boot failures or crashes when accessing persistent memory.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes the fix commits. Test persistent memory device initialization without crashes.

📡 Detection & Monitoring

Log Indicators:

BUG: unable to handle page fault for address
#PF: supervisor write access in kernel mode
Oops: 0002
page fault in vmemmap_set_pmd() or __init_single_page()

SIEM Query:

kernel_log: "BUG: unable to handle page fault" OR kernel_log: "Oops: 0002" OR kernel_log: "vmemmap_set_pmd"

📊 Metadata

CVE ID: CVE-2025-39845

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.02% exploit probability (5.5th percentile)

Published: September 19, 2025

Last Updated: January 20, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-39845, you might also want to check these: