Security readout for executives and security teams
Plain-English summary
A local low-privilege user may trigger a Linux kernel race involving huge-page files. The observed result is a kernel BUG and bad page-cache state, creating serious availability risk; the supplied CVSS also rates confidentiality and integrity impacts high. The issue is not described as remotely exploitable.
Executive priority
Prioritize remediation on shared compute, virtualization, database, and high-performance systems using huge pages. Accelerate patching where untrusted or tenant-controlled local workloads run. Other systems should enter the normal high-severity kernel update cycle after confirming exposure with the operating-system vendor.
Technical view
During concurrent hugetlbfs hole punching and folio migration, a mapped-state check occurs without the folio lock. A temporary migration entry can make the folio appear unmapped. Migration then fails, restores the mapping, and deletion encounters a still-mapped folio, triggering the reported page-cache BUG. The fix locks the folio before checking its mapped state.
Likely exposure
Exposure is most likely on Linux systems using hugetlbfs or application-managed huge pages and allowing low-privileged local code execution. The supplied vector is local with low privileges and no user interaction. The bundle's version metadata is broad and insufficiently clear for determining exact distribution package ranges.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector reports low attack complexity, but the underlying condition involves a concurrency race. Treat exploitation status as unconfirmed rather than assuming the issue is being weaponized.
Researcher notes
The reported invariant failure occurs because folio_mapped() can return false while page-table entries are temporarily represented as migration entries. An extra reference prevents migration completion, after which the normal mapping is restored. Locking serializes the mapped-state check against migration. No CWE was supplied, and the precise confidentiality or integrity mechanism is not documented.
Mitigation direction
- Identify Linux systems using hugetlbfs or application-managed huge pages.
- Apply a vendor-supported kernel update incorporating the cited stable fix.
- Prioritize shared or multi-user hosts where low-privileged local code can run.
- If patching is delayed, consult vendor guidance for supported exposure-reduction measures.
Validation and detection
- Record running kernel versions and compare them with current distribution security advisories.
- Confirm the installed kernel changelog includes the CVE or corresponding stable commit.
- Verify patched systems booted into the updated kernel.
- Monitor for "Bad page cache" or "still mapped when deleted" kernel diagnostics.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40006 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bc1c9ce8aeff45318332035dbef9713fb9e982d7CVE reference, Linux
- https://git.kernel.org/stable/c/91f548e920fbf8be3f285bfa3fa045ae017e836dCVE reference, Linux
- https://git.kernel.org/stable/c/3e851448078f5b01f6264915df3cfef75e323a12CVE reference, Linux
- https://git.kernel.org/stable/c/c1dc0524ab2cc3982d4e0d2bfac71a0cd4d65c39CVE reference, Linux
- https://git.kernel.org/stable/c/c9c2a51f91aea70e89b496cac360cd795a2b3c26CVE reference, Linux
- https://git.kernel.org/stable/c/910d7749346c4b0acdc6e4adfdc4a9984281a206CVE reference, Linux
- https://git.kernel.org/stable/c/21ee79ce938127f88fe07e409c1817f477dbe7eaCVE reference, Linux
- https://git.kernel.org/stable/c/7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.