CVE-2025-40353: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40353 is a Linux kernel bug in the arm64 Memory Tagging Extension (MTE) subsystem, specifically in the copy_highpage() function. The issue causes a spurious WARN_ON_ONCE kernel warning when a destination page that has already been MTE-tagged (PG_mte_tagged set) is copied to a second time during a failed memory migration retry. This regression was introduced following commit 060913999d7a ("mm: migrate: support poisoned recover from migrate folio"), which changed the order of folio_mc_copy() and __folio_migrate_mapping() calls. The vulnerability affects the Linux kernel from its initial commit up to (but not including) the patched versions 6.12.56, 6.17.6, and 6.18. It was published on December 16, 2025, with an EPSS score of 0.00017 (very low) and no CVSS base score has been assigned (Feedly, EUVD).

The root cause is a logic flaw (CWE-670: Always-Incorrect Control Flow Implementation) in the arm64 copy_highpage() function, which incorrectly assumes the destination page is always freshly allocated and therefore never MTE-tagged. Following the introduction of poisoned-folio migration recovery support, folio_mc_copy() is invoked before __folio_migrate_mapping(); if the mapping step fails with -EAGAIN, the copy is retried to the same destination page. Because copy_highpage() already set PG_mte_tagged on the first attempt, the second call triggers a WARN_ON_ONCE. The fix replaces the WARN_ON_ONCE assertion with a comment, acknowledging that re-tagging an already-tagged page is a valid scenario in this migration retry path (Feedly, Kernel Patch 1).

The primary impact of this vulnerability is availability: the spurious kernel warning can trigger a WARN_ON_ONCE in production systems running arm64 kernels with MTE enabled, potentially causing kernel log noise and, in configurations where kernel warnings are treated as fatal (e.g., panic_on_warn=1), could result in a kernel panic and system crash. There is no evidence of confidentiality or integrity impact, and the issue is limited to arm64 hardware with MTE support during memory migration failure scenarios (Feedly).

The Linux kernel maintainers have released patches addressing this issue in stable versions 6.12.56, 6.17.6, and 6.18. The fix replaces the WARN_ON_ONCE in copy_highpage() with a comment, preventing spurious warnings during migration retries. Administrators running arm64 systems with MTE enabled should upgrade to one of the patched kernel versions. The relevant upstream commits are 5ff5765a1fc526f07d3bbaedb061d970eb13bcf4, 0bbf3fc6e9211fce9889fe8efbb89c220504d617, and b98c94eed4a975e0c80b7e90a649a46967376f58 (Feedly, Kernel Patch 1).