CVE-2025-40199: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40199 is a Linux kernel vulnerability in the page_pool subsystem where an overly wide PP_MAGIC_MASK causes false positives in page_pool_page_is_pp(), leading to system crashes on boot on certain 32-bit architectures (notably 32-bit parisc). The issue was introduced by a prior patch that set PP_DMA_INDEX_BITS too broadly, causing arbitrary kernel pointers to be mistaken for page_pool-tagged pages. It was published on November 12, 2025, and affects Linux kernel versions prior to the fixes backported to stable branches. NVD has not yet assigned a CVSS score; Feedly estimates the severity as HIGH (Feedly).

The root cause is an incorrect bitmask definition (PP_MAGIC_MASK / PP_DMA_INDEX_BITS) in the Linux kernel's page_pool memory management subsystem. On 32-bit architectures where the virtual address space is more constrained, the mask is set too wide, causing page_pool_page_is_pp() to return false positives when evaluating arbitrary kernel pointers that happen to alias with the pp_magic field. The fix redefines PP_DMA_INDEX_BITS using the lowest bit of PAGE_OFFSET as the upper bound of PP_DMA_INDEX_MASK, ensuring kernel pointers above PAGE_OFFSET are not misidentified; when insufficient bits are available (fewer than 8), dma_index storage is disabled as a fallback. No formal CWE classification has been assigned by NVD (Feedly).

The primary impact is a kernel crash (denial of service) on boot for systems running affected Linux kernel versions on 32-bit architectures, particularly 32-bit parisc. The false positive detection in page_pool_page_is_pp() causes the kernel to mishandle memory pages, resulting in an unrecoverable crash during system initialization. There is no known confidentiality or integrity impact; the vulnerability is limited to availability on the affected subset of architecture configurations (Feedly).

There is no evidence of in-the-wild exploitation or public proof-of-concept exploit code for CVE-2025-40199. The vulnerability manifests as a boot-time crash rather than a remotely triggerable condition, significantly limiting its exploitability as an attack vector. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Patched commits are available at kernel.org for the affected stable series, with fixes included in Linux 6.12.54, 6.17.4, and 6.18-rc1 (Feedly). Administrators running 32-bit Linux systems (particularly parisc) should update to a patched kernel version. No configuration-based workaround is available; upgrading the kernel is the only remediation.