CVE-2025-37818: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37818 is a vulnerability discovered in the Linux kernel's LoongArch architecture, specifically in the huge_pte_offset() function. The vulnerability was disclosed on May 8, 2025, affecting various Linux distributions and their kernel implementations (NVD).

The vulnerability stems from the huge_pte_offset() function incorrectly returning a pointer to a PMD slot even when the underlying entry points to invalid_pte_table, indicating no mapping exists. When callers like smaps_hugetlb_range() fetch this invalid entry value through the pointer, the generic is_swap_pte() check incorrectly identifies this address as a swap entry on LoongArch because it satisfies the '!pte_present() && !pte_none()' conditions. This misinterpretation, combined with a coincidental match by is_migration_entry() on the address bits, leads to kernel crashes in pfn_swap_entry_to_page() (Wiz).

The vulnerability can result in kernel crashes when the system attempts to process certain memory operations involving huge pages on LoongArch systems, potentially leading to system instability and denial of service conditions (Wiz).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating a moderate severity level with local attack vector and low attack complexity (Red Hat).

The issue has been resolved by modifying huge_pte_offset() to check the PMD entry's content using pmd_none() before returning. If the entry is invalid (i.e., it points to invalid_pte_table), the function now returns NULL instead of the pointer to the slot (NVD).