# CVE-2025-39845

## Summary

- **CVE ID:** CVE-2025-39845
- **Severity:** MEDIUM
- **CVSS Score:** 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Sep 19, 2025
- **Last Modified:** Sep 8, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()

Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure
page tables are properly synchronized when calling p*d_populate_kernel().

For 5-level paging, synchronization is performed via
pgd_populate_kernel().  In 4-level paging, pgd_populate() is a no-op, so
synchronization is instead performed at the P4D level via
p4d_populate_kernel().

This fixes intermittent boot failures on systems using 4-level paging and
a large amount of persistent memory:

  BUG: unable to handle page fault for address: ffffe70000000034
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  RIP: 0010:__init_single_page+0x9/0x6d
  Call Trace:
   <TASK>
   __init_zone_device_page+0x17/0x5d
   memmap_init_zone_device+0x154/0x1bb
   pagemap_range+0x2e0/0x40f
   memremap_pages+0x10b/0x2f0
   devm_memremap_pages+0x1e/0x60
   dev_dax_probe+0xce/0x2ec [device_dax]
   dax_bus_probe+0x6d/0xc9
   [... snip ...]
   </TASK>

It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap
before sync_global_pgds() [1]:

  BUG: unable to handle page fault for address: ffffeb3ff1200000
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI
  Tainted: [W]=WARN
  RIP: 0010:vmemmap_set_pmd+0xff/0x230
   <TASK>
   vmemmap_populate_hugepages+0x176/0x180
   vmemmap_populate+0x34/0x80
   __populate_section_memmap+0x41/0x90
   sparse_add_section+0x121/0x3e0
   __add_pages+0xba/0x150
   add_pages+0x1d/0x70
   memremap_pages+0x3dc/0x810
   devm_memremap_pages+0x1c/0x60
   xe_devm_add+0x8b/0x100 [xe]
   xe_tile_init_noalloc+0x6a/0x70 [xe]
   xe_device_probe+0x48c/0x740 [xe]
   [... snip ...]

## Affected Products

- Linux — Linux (8d400913c231bd1da74067255816453f96cd35b0)
- Linux — Linux (5.13)
- Linux — Linux (0)
- Linux — Linux (5.15.192)
- Linux — Linux (6.1.151)
- Linux — Linux (6.6.105)
- Linux — Linux (6.12.46)
- Linux — Linux (6.16.6)
- Linux — Linux (6.17)

## References

- [CNA](https://git.kernel.org/stable/c/744ff519c72de31344a627eaf9b24e9595aae554)
- [CNA](https://git.kernel.org/stable/c/5f761d40ee95d2624f839c90ebeef2d5c55007f5)
- [CNA](https://git.kernel.org/stable/c/26ff568f390a531d1bd792e49f1a401849921960)
- [CNA](https://git.kernel.org/stable/c/b7f4051dd3388edd30e9a6077c05c486aa31e0d4)
- [CNA](https://git.kernel.org/stable/c/6bf9473727569e8283c1e2445c7ac42cf4fc9fa9)
- [CNA](https://git.kernel.org/stable/c/6659d027998083fbb6d42a165b0c90dc2e8ba989)
- [CVE](https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.15%
- **EPSS Percentile:** 4.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._