CVE-2025-40245 Details
Description
In the Linux kernel, the following vulnerability has been resolved: nios2: ensure that memblock.current_limit is set when setting pfn limits On nios2, with CONFIG_FLATMEM set, the kernel relies on memblock_get_current_limit() to determine the limits of mem_map, in particular for max_low_pfn. Unfortunately, memblock.current_limit is only default initialized to MEMBLOCK_ALLOC_ANYWHERE at this point of the bootup, potentially leading to situations where max_low_pfn can erroneously exceed the value of max_pfn and, thus, the valid range of available DRAM. This can in turn cause kernel-level paging failures, e.g.: [ 76.900000] Unable to handle kernel paging request at virtual address 20303000 [ 76.900000] ea = c0080890, ra = c000462c, cause = 14 [ 76.900000] Kernel panic - not syncing: Oops [ 76.900000] ---[ end Kernel panic - not syncing: Oops ]--- This patch fixes this by pre-calculating memblock.current_limit based on the upper limits of the available memory ranges via adjust_lowmem_bounds, a simplified version of the equivalent implementation within the arm architecture.
A vulnerability in the Linux kernel for the Nios2 architecture has been addressed. With the CONFIG_FLATMEM option enabled, the kernel improperly initializes the memory block limits, which can cause the maximum low page frame number (max_low_pfn) to exceed the actual physical memory limits. This misconfiguration can lead to kernel paging errors and system crashes. The issue arises because the memory block current limit is only set to allocate memory anywhere by default, allowing the low memory page frame number to incorrectly surpass the available memory range, potentially causing paging failures and kernel panics.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version where this issue has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 4, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/25f09699edd360b534ccae16bc276c3b52c471f3 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/5c3e38a367822f036227dd52bac82dc4a05157e2 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/8912814f14e298b83df072fecc1f7ed1b63b1b2c | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/90f5f715550e07cd6a51f80fc3f062d832c8c997 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/a20b83cf45be2057f3d073506779e52c7fa17f94 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/b1ec9faef7e36269ca3ec890972a78effbaeb975 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 4, 2025 | New CVE Received | kernel.org |
Volerion