CVE-2025-68211: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68211 is a denial-of-service vulnerability in the Linux kernel's KSM (Kernel Samepage Merging) subsystem, specifically in the scan_get_next_rmap_item() function. The function inefficiently walks every page address in a virtual memory area (VMA) to locate mergeable pages, becoming highly inefficient when scanning large VMAs with mostly unmapped regions. Affected kernel versions include 2.6.32 through 5.10.249, 5.11 through 5.15.199, 5.16 through 6.1.161, 6.2 through 6.6.121, 6.7 through 6.12.59, 6.13 through 6.17.9, and release candidates 6.18-rc1 through 6.18-rc5. It was published on December 16, 2025, with patches released in February 2026. The CVSS v3.1 base score is 5.5 (Medium) (Feedly).

The root cause is an algorithmic inefficiency (CWE-400: Uncontrolled Resource Consumption) in the KSM subsystem's scan_get_next_rmap_item() function, which performs a per-address page lookup across the entire VMA range rather than skipping unmapped holes. A local, low-privileged attacker can exploit this by creating a very large anonymous mapping (e.g., 32 TiB) with mmap() using MAP_NORESERVE, populating only a single page to obtain an anon_vma, and then calling madvise() with MADV_MERGEABLE to enable KSM scanning on the region. The fix replaces the per-address lookup with a range walk using walk_page_range(), allowing KSM to skip over entire unmapped holes in a VMA. Patches are available across multiple stable kernel branches (Feedly, Kernel Patch).

Successful exploitation causes the ksmd kernel daemon to consume up to 100% CPU for extended periods (over an hour in demonstrated cases) while performing little to no actual memory deduplication work. This results in a denial-of-service condition affecting system availability — confidentiality and integrity are not impacted. The attack is confined to the local system, but the resource exhaustion can degrade overall system performance and starve other processes of CPU time (Feedly).

1. Obtain local access: Gain a low-privileged shell on a system running a vulnerable Linux kernel version with KSM enabled.
2. Create a large sparse mapping: Use mmap() with MAP_NORESERVE | MAP_PRIVATE | MAP_ANON flags to allocate a very large virtual memory region (e.g., 32 TiB) without actually committing physical memory.
3. Populate a single page: Write to the first byte of the mapped region to fault in a single physical page and establish an anon_vma structure, which is required for KSM to track the region.
4. Enable KSM scanning: Call madvise(area, size, MADV_MERGEABLE) on the entire mapped region to instruct the kernel to scan it for duplicate pages.
5. Trigger CPU exhaustion: The ksmd daemon will begin scanning the entire VMA address range page-by-page, consuming up to 100% CPU for an extended period (over an hour for a 32 TiB mapping with one populated page) while performing no meaningful deduplication (Feedly).

• Process: Sustained high CPU utilization (near 100%) by the ksmd kernel thread ([ksmd]) visible in top, htop, or ps aux output with minimal memory deduplication progress.
• Logs: Kernel logs (dmesg, /var/log/kern.log) may show KSM-related activity; monitoring tools may report ksmd as a top CPU consumer over extended periods.
• System Metrics: Unusually low KSM pages_shared/pages_sharing ratio relative to ksmd CPU consumption, observable via /sys/kernel/mm/ksm/pages_shared and /sys/kernel/mm/ksm/pages_sharing.
• Memory Maps: Presence of extremely large anonymous mappings (tens of terabytes) with very few populated pages in /proc/<pid>/maps or /proc/<pid>/smaps for a low-privileged process, combined with MADV_MERGEABLE advisory set.

Update the Linux kernel to one of the following patched versions: 5.10.249 or later, 5.15.199 or later, 6.1.161 or later, 6.6.121 or later, 6.12.59 or later, or 6.17.9 or later. Patches have been released across multiple stable branches and are available via the kernel stable tree (Kernel Patch). As a workaround, administrators can disable KSM entirely by writing 0 to /sys/kernel/mm/ksm/run, or restrict unprivileged access to madvise() with MADV_MERGEABLE through mandatory access control policies (e.g., SELinux, AppArmor). Debian, Ubuntu (USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), Oracle Linux, and Amazon Linux 2 have all issued distribution-level advisories and updated packages (Ubuntu Advisory, Debian LTS).

The vulnerability has received routine coverage from Linux distribution security teams, with Debian, Ubuntu, Oracle Linux, Amazon Linux 2, and Yocto Project all issuing advisories and updated packages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard distribution security channels.