Overview
CVE-2025-40245 identifies a critical vulnerability within the Linux kernel affecting the Nios2 architecture when configured with CONFIG_FLATMEM. This flaw stems from the improper initialization of memory limits during early boot, potentially leading to kernel panics due to out-of-bounds memory access. A patch has been released to address this issue.
Technical Details
The root cause of CVE-2025-40245 lies in the way the memblock.current_limit is handled during the kernel’s boot process on Nios2 systems with CONFIG_FLATMEM enabled. The kernel relies on memblock_get_current_limit() to determine the bounds of mem_map, specifically for calculating max_low_pfn. Before the patch, memblock.current_limit was initialized to MEMBLOCK_ALLOC_ANYWHERE. This delayed initialization could result in max_low_pfn exceeding max_pfn, leading to memory access beyond the available DRAM range.
The consequence of this incorrect limit calculation is potential kernel-level paging failures, manifested as kernel panics, similar to the following example:
[ 76.900000] Unable to handle kernel paging request at virtual address 20303000
[ 76.900000] ea = c0080890, ra = c000462c, cause = 14
[ 76.900000] Kernel panic - not syncing: Oops
[ 76.900000] ---[ end Kernel panic - not syncing: Oops ]---
The fix introduces a pre-calculation of memblock.current_limit based on the upper limits of available memory ranges using adjust_lowmem_bounds. This approach mirrors the equivalent implementation found in the ARM architecture, ensuring accurate memory limit initialization.
CVSS Analysis
At the time of writing, a CVSS score has not been assigned to CVE-2025-40245. However, the potential for kernel panics indicates a high severity vulnerability. The lack of a formal CVSS score does not diminish the importance of applying the patch.
Possible Impact
The primary impact of CVE-2025-40245 is system instability leading to denial of service. An attacker able to trigger specific memory allocation scenarios could cause a kernel panic, crashing the affected system. This is particularly concerning in embedded systems or critical infrastructure relying on Nios2 and CONFIG_FLATMEM.
Mitigation or Patch Steps
The recommended mitigation is to apply the provided patch to your Linux kernel source code and rebuild the kernel. The patch addresses the incorrect memory limit initialization, preventing the potential for kernel panics. Refer to the reference links below for the specific patches.
Alternatively, if patching is not immediately feasible, consider disabling CONFIG_FLATMEM if possible. However, this might not be an option depending on the system’s memory configuration and hardware limitations.
References
https://git.kernel.org/stable/c/25f09699edd360b534ccae16bc276c3b52c471f3
https://git.kernel.org/stable/c/5c3e38a367822f036227dd52bac82dc4a05157e2
https://git.kernel.org/stable/c/8912814f14e298b83df072fecc1f7ed1b63b1b2c
https://git.kernel.org/stable/c/90f5f715550e07cd6a51f80fc3f062d832c8c997
https://git.kernel.org/stable/c/a20b83cf45be2057f3d073506779e52c7fa17f94
https://git.kernel.org/stable/c/b1ec9faef7e36269ca3ec890972a78effbaeb975
