CVE-2025-40230: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40230 is a Linux kernel vulnerability in the Transparent Huge Page (THP) splitting mechanism that can cause a kernel panic instead of gracefully terminating an affected userspace process during memory error handling. The flaw was published on December 4, 2025, and affects the Linux kernel's memory management subsystem. When a Machine Check Exception (MCE) occurs in userspace on x86 systems, the kernel's attempt to split a THP triggers a second in-kernel #MC by reading poisoned memory pages, leading to a fatal kernel panic. The CVSS score has not been publicly assigned at this time, and the CVE status remains unknown (Feedly).

The root cause lies in the THP splitting path, specifically in the try_to_map_unused_to_zeropage() function, which reads pages within a THP to identify zero-filled pages during a split operation. When a page within the THP has been hardware-poisoned (e.g., due to a memory error injected or detected via x86 Machine Check Exception), reading that page triggers a second #MC inside the kernel before the initial memory_failure() call completes. This second in-kernel #MC is unrecoverable, causing the kernel to panic with the message "Data load in unrecoverable area of kernel" rather than allowing the x86 MCE recovery path to terminate only the affected userspace process. The fix prevents consumption of the hardware poison during THP splitting by skipping or protecting the read of poisoned pages (Feedly, Kernel Commit 1, Kernel Commit 2).

Successful triggering of this vulnerability results in a kernel panic (denial of service), crashing the entire system rather than isolating the fault to the affected userspace process. On x86 systems, the Machine Check Exception architecture is designed to recover from in-userspace memory errors by terminating only the faulting process, but this bug bypasses that recovery mechanism and causes a system-wide outage. There is no evidence of confidentiality or integrity impact beyond availability loss; however, a system crash can disrupt all services running on the affected host (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-40230. The vulnerability requires a hardware memory error (or memory error injection capability) on an x86 system with THP enabled and a mapped THP in a userspace process, making opportunistic exploitation unlikely. The EPSS score is very low at 0.000170 (approximately 0.017%), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

The fix is addressed in the Linux kernel stable tree via patches committed to the stable branches (see commits 6fc0a7c99e97, 92acf4b04f25, and 841a8bfcbad9). Users should update to a patched kernel version that includes the fix for mm: prevent poison consumption when splitting THP. Linux distribution vendors (e.g., SUSE, as noted in Tenable plugin detections) are expected to backport this fix into their supported kernel packages. As a workaround, disabling Transparent Huge Pages (echo never > /sys/kernel/mm/transparent_hugepage/enabled) can mitigate the issue at the cost of potential performance impact (Feedly, Tenable Plugin).

The vulnerability was detected by Nessus (plugin IDs 277595 and 304219) and Qualys (detection IDs 6031981, 6032019, 761861), indicating it has been incorporated into standard vulnerability scanning tools. A Japanese security advisory site (security.sios.jp) covered the issue in December 2025. No notable public researcher commentary or significant social media discussion has been identified (Feedly, Tenable Plugin).