CVE-2025-40245: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40245 is a Linux kernel vulnerability affecting the nios2 architecture when CONFIG_FLATMEM is enabled, caused by incorrect initialization of memblock.current_limit during boot. This flaw can lead to max_low_pfn erroneously exceeding max_pfn, resulting in kernel-level paging failures and kernel panic. It was published on December 4, 2025, and affects Linux kernel versions from the initial commit up to the fixes backported into stable releases. The CVSS v3.1 base score is 5.5 (Medium), reflecting a local attack vector with low privileges required and high availability impact (Red Hat CVE, Microsoft MSRC).

The root cause is improper initialization (CWE-665) of memblock.current_limit, which defaults to MEMBLOCK_ALLOC_ANYWHERE at early boot on nios2 systems with CONFIG_FLATMEM. Because the kernel uses memblock_get_current_limit() to determine max_low_pfn, this default value can cause max_low_pfn to exceed max_pfn, pushing memory map calculations beyond the valid DRAM range. The fix introduces an adjust_lowmem_bounds function — modeled after the ARM architecture's equivalent — that pre-calculates memblock.current_limit based on the actual upper limits of available memory ranges before PFN limits are set. No public proof-of-concept exploit code is known to exist (Red Hat CVE).

Exploitation of this vulnerability results in kernel panic with an "Unable to handle kernel paging request" error, causing a complete denial of service (system crash) on affected nios2 systems. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Affected systems running nios2 architecture with CONFIG_FLATMEM may experience unrecoverable crashes during or after boot (Red Hat CVE, Microsoft MSRC).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2025-40245. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to local, low-privileged attackers on nios2 architecture systems with CONFIG_FLATMEM enabled, which significantly narrows the attack surface (Red Hat CVE).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include: 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, and 6.18. Microsoft has also addressed this in Azure Linux 3 (kernel package azl3_kernel_6.6.112.1-2 and later). Administrators should update to a patched kernel version and monitor system logs for paging-related errors on nios2 systems. No configuration-based workaround is available beyond disabling CONFIG_FLATMEM, which requires a kernel rebuild (Red Hat CVE, Microsoft MSRC).