CVE-2025-40218: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40218 is a denial-of-service vulnerability in the Linux kernel's DAMON (Data Access Monitoring) virtual address space operation subsystem (mm/damon/vaddr) that can cause an infinite page table walk, resulting in a soft lockup. The flaw was published on December 4, 2025, and affects Linux kernel versions from 6.5 up to the patched releases (6.6.113, 6.12.54, 6.17.4, and 6.18). It carries a CVSS v3.1 base score of 4.1 (Medium), requiring high privileges and local access with high attack complexity (Feedly, Microsoft MSRC).

The root cause is an improper loop control (CWE-835: Loop with Unreachable Exit Condition) in the DAMON vaddr page table walk callback. Specifically, pte_offset_map_lock() is called inside the callback to read/write page table accessed bits; when it fails, the code returns ACTION_AGAIN to retry the walk. If the target is a PMD (Page Middle Directory) migration entry and the migration cannot complete before the walk finishes, pte_offset_map_lock() fails indefinitely, creating an infinite loop. This was observed to cause a real soft lockup when CPU hotplugging and DAMON monitoring ran concurrently. The fix eliminates the retry logic — since DAMON guarantees only best-effort accuracy, skipping access tracking for such pages is acceptable (Feedly).

Successful triggering of this vulnerability causes a kernel soft lockup, rendering the affected system unresponsive or severely degraded in performance. The impact is limited to availability (no confidentiality or integrity loss), and exploitation requires a local attacker with high privileges who can simultaneously run DAMON monitoring and trigger CPU hotplugging operations. There is no known potential for lateral movement or data exfiltration from this vulnerability (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with high privileges and a specific concurrent workload (DAMON + CPU hotplug), making opportunistic exploitation unlikely (Feedly).

Patches are available for multiple stable Linux kernel branches: versions 6.6.113, 6.12.54, 6.17.4, and 6.18 include the fix. The patch removes the ACTION_AGAIN retry from the DAMON vaddr page table walk callback so that a failed pte_offset_map_lock() is simply skipped rather than retried indefinitely. As a temporary workaround, administrators can disable DAMON monitoring during CPU hotplugging operations or avoid running both concurrently until the kernel is updated. Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.112.1-2 and later) (Feedly, Microsoft MSRC).