CKI KWF Bot 71b3c5829b Merge: CVE-2025-68211 kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item ...

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8345

An unprivileged local user can mark a huge sparse anonymous mapping (e.g. tens of TiB with only a few pages populated) as MADV_MERGEABLE, which causes ksmd to walk every virtual page address instead of skipping unmapped holes. That pins a CPU for a long time and effectively stalls Kernel Samepage Merging, so it is a local denial-of-service against the system’s page-deduplication path. The fix switches scan_get_next_rmap_item() to walk_page_range() so KSM jumps over holes and only scans mapped pages.

The following commit comes from the 6.6 stable tree.

CVE: CVE-2025-68211

JIRA: https://redhat.atlassian.net/browse/RHEL-189902

Signed-off-by: Nico Pache <npache@redhat.com>

Approved-by: Ricardo Robaina <rrobaina@redhat.com>
Approved-by: Luiz Capitulino <luizcap@redhat.com>
Approved-by: Rafael Aquini <raquini@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>

2026-08-04 08:11:29 +00:00

..

damon

mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure

2026-03-23 11:31:01 -04:00

kasan

fix missing vmalloc.h includes

2026-05-31 15:28:18 -05:00

kfence

…

kmsan

Merge: RHEL 9 MM subsystem proactive follow up fixes

2025-12-03 13:14:13 +00:00

backing-dev.c

…

balloon_compaction.c

…

bootmem_info.c

…

cma_debug.c

…

cma_sysfs.c

…

cma.c

…

cma.h

…

compaction.c

mm: Create/affine kcompactd to its preferred node

2026-01-20 11:14:06 -05:00

debug_page_alloc.c

…

debug_page_ref.c

…

debug_vm_pgtable.c

fix missing vmalloc.h includes

2026-05-31 15:28:18 -05:00

debug.c

…

dmapool_test.c

…

dmapool.c

…

early_ioremap.c

mm/early_ioremap: add null pointer checks to prevent NULL-pointer dereference

2025-11-17 12:26:31 -05:00

fadvise.c

…

fail_page_alloc.c

…

failslab.c

…

filemap.c

…

folio-compat.c

…

gup_test.c

…

gup_test.h

…

gup.c

mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()

2025-11-14 11:37:19 -05:00

highmem.c

…

hmm.c

…

huge_memory.c

…

hugetlb_cgroup.c

…

hugetlb_vmemmap.c

…

hugetlb_vmemmap.h

…

hugetlb.c

mm/hugetlb.c: undo errant change

2026-06-15 18:03:17 +02:00

hwpoison-inject.c

…

init-mm.c

…

internal.h

mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries

2026-07-02 15:09:23 -04:00

interval_tree.c

…

io-mapping.c

…

ioremap.c

…

Kconfig

x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers

2026-03-24 11:09:13 -03:00

Kconfig.debug

…

khugepaged.c

…

kmemleak.c

…

ksm.c

Merge: CVE-2025-68211 kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item

2026-08-04 08:11:29 +00:00

list_lru.c

…

maccess.c

…

madvise.c

…

Makefile

…

mapping_dirty_helpers.c

…

memblock.c

memblock: Accept allocated memory before use in memblock_double_array()

2026-01-23 08:52:20 -05:00

memcontrol-v1.c

…

memcontrol-v1.h

…

memcontrol.c

mm/memcg: refactor try_charge_memcg retry logic to use for loop

2026-07-02 15:29:31 -04:00

memfd.c

…

memory_hotplug.c

kaslr: rename physmem_end and PHYSMEM_END to direct_map_physmem_end

2026-03-24 11:09:08 -03:00

memory-failure.c

…

memory-tiers.c

…

memory.c

Merge: RHEL 9 MM subsystem proactive follow up fixes

2025-12-03 13:14:13 +00:00

mempolicy.c

futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

2026-06-10 15:18:09 -04:00

mempool.c

…

memremap.c

…

memtest.c

…

migrate_device.c

…

migrate.c

migrate: correct lock ordering for hugetlb file folios

2026-02-26 11:23:50 -05:00

mincore.c

…

mlock.c

…

mm_init.c

…

mm_slot.h

…

mmap_lock.c

…

mmap.c

…

mmu_gather.c

mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather

2026-03-03 10:00:45 -05:00

mmu_notifier.c

…

mmzone.c

…

mprotect.c

…

mremap.c

…

msync.c

…

nommu.c

…

oom_kill.c

memcg: fix soft lockup in the OOM process

2026-03-10 23:11:03 -04:00

page_alloc.c

mm/page_alloc: clear page->private in free_pages_prepare()

2026-05-12 08:18:01 -04:00

page_counter.c

…

page_ext.c

…

page_idle.c

…

page_io.c

…

page_isolation.c

…

page_owner.c

…

page_poison.c

…

page_reporting.c

…

page_reporting.h

…

page_table_check.c

…

page_vma_mapped.c

…

page-writeback.c

…

pagewalk.c

…

percpu-internal.h

…

percpu-km.c

…

percpu-stats.c

…

percpu-vm.c

…

percpu.c

mm: introduce and use {pgd,p4d}_populate_kernel()

2026-03-03 10:00:38 -05:00

pgalloc-track.h

…

pgtable-generic.c

…

process_vm_access.c

…

ptdump.c

…

readahead.c

…

rmap.c

mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather

2026-03-03 10:00:45 -05:00

rodata_test.c

…

secretmem.c

…

shmem_quota.c

…

shmem.c

mm: shmem: add missing shmem_unacct_size() in __shmem_file_setup()

2025-11-14 11:37:19 -05:00

show_mem.c

…

shrinker_debug.c

…

shrinker.c

…

shuffle.c

…

shuffle.h

…

slab_common.c

…

slab.c

…

slab.h

…

slub.c

…

sparse-vmemmap.c

mm: introduce and use {pgd,p4d}_populate_kernel()

2026-03-03 10:00:38 -05:00

sparse.c

kaslr: rename physmem_end and PHYSMEM_END to direct_map_physmem_end

2026-03-24 11:09:08 -03:00

swap_cgroup.c

…

swap_slots.c

…

swap_state.c

…

swap.c

…

swap.h

…

swapfile.c

…

truncate.c

…

usercopy.c

…

userfaultfd.c

…

util.c

mm/util: Introduce kmemdup_array()

2026-02-03 18:08:37 -05:00

vmalloc.c

…

vmpressure.c

…

vmscan.c

mm/vmscan: add sysctl to limit direct reclaim scanning depth

2026-07-02 15:40:42 -04:00

vmstat.c

…

workingset.c

mm: memcg: use rstat for non-hierarchical stats

2026-01-23 08:32:28 +00:00

z3fold.c

…

zbud.c

…

zpool.c

…

zsmalloc.c

…

zswap.c

mm: memcg: add NULL check to obj_cgroup_put()

2026-01-23 08:32:52 +00:00