CVE-2025-37868: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-37868 is a vulnerability discovered in the Linux kernel affecting the drm/xe/userptr component, specifically related to a notifier vs folio deadlock issue. The vulnerability was disclosed on May 9, 2025, and involves a potential deadlock condition in the kernel's memory management subsystem (NVD).

The vulnerability occurs when migratepagesbatch() on the core kernel side holds folio lock(s) while interacting with mappings tied to userptr, which triggers the notifier callback and attempts to grab the notifier lock. Under specific timing conditions, pages pulled from the hmm fault can be intercepted by migratepagesbatch() while holding the notifier lock to mark pages as accessed/dirty. This creates a deadlock scenario since the folio lock won't be released until the notifier lock is dropped (NVD). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5, indicating moderate severity (Red Hat).

The vulnerability can result in a system deadlock, potentially affecting system stability and performance. The issue specifically impacts the memory management functionality of the Linux kernel, particularly in scenarios involving page migration and memory access operations (NVD).

The issue has been resolved by removing the unnecessary markpageaccessed/dirty operation, as this functionality was already being handled by hmm fault. The fix has been implemented through a patch that was cherry-picked from commit bd7c0cb695e87c0e43247be8196b4919edbe0e85 (NVD).