---
id: CVE-2025-40199
title: 'page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches

  Helge reported that the introduction of PP_MAGIC_MASK let to crashes on
  boot on his 32-bit parisc …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4f51fb0d257ff4d406ec27966902de075e3b118e <
    15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a
  - >-
    Linux >= ee62ce7a1d909ccba0399680a03c2dee83bcae95 <
    f62934cea32c8f7b11b747975d69bf5afe4264cf
  - >-
    Linux >= ee62ce7a1d909ccba0399680a03c2dee83bcae95 <
    95920c2ed02bde551ab654e9749c2ca7bc3100e0
  - Linux c30ae60f41f9edd6e1b5cad41cf28ce04dae39e4
  - Linux >= 6.12.34 < 6.12.54
  - Linux >= 6.15.3 < 6.16
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:57:57.920017Z'
published: '2025-11-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:40.424Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40199'
references:
  - url: 'https://git.kernel.org/stable/c/15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a'
  - url: 'https://git.kernel.org/stable/c/f62934cea32c8f7b11b747975d69bf5afe4264cf'
  - url: 'https://git.kernel.org/stable/c/95920c2ed02bde551ab654e9749c2ca7bc3100e0'
tags:
  - cve.org
epss: 0.00151
epssPercentile: 0.03835
ingestedAt: '2026-10-15T22:48:25.551Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches

Helge reported that the introduction of PP_MAGIC_MASK let to crashes on
boot on his 32-bit parisc machine. The cause of this is the mask is set
too wide, so the page_pool_page_is_pp() incurs false positives which
crashes the machine.

Just disabling the check in page_pool_is_pp() will lead to the page_pool
code itself malfunctioning; so instead of doing this, this patch changes
the define for PP_DMA_INDEX_BITS to avoid mistaking arbitrary kernel
pointers for page_pool-tagged pages.

The fix relies on the kernel pointers that alias with the pp_magic field
always being above PAGE_OFFSET. With this assumption, we can use the
lowest bit of the value of PAGE_OFFSET as the upper bound of the
PP_DMA_INDEX_MASK, which should avoid the false positives.

Because we cannot rely on PAGE_OFFSET always being a compile-time
constant, nor on it always being >0, we fall back to disabling the
dma_index storage when there are not enough bits available. This leaves
us in the situation we were in before the patch in the Fixes tag, but
only on a subset of architecture configurations. This seems to be the
best we can do until the transition to page types in complete for
page_pool pages.

v2:
- Make sure there's at least 8 bits available and that the PAGE_OFFSET
  bit calculation doesn't wrap

## Affected

- `Linux >= 4f51fb0d257ff4d406ec27966902de075e3b118e < 15b8a5b4cdc16e9a8bb2a548e12a0fd92997605a`
- `Linux >= ee62ce7a1d909ccba0399680a03c2dee83bcae95 < f62934cea32c8f7b11b747975d69bf5afe4264cf`
- `Linux >= ee62ce7a1d909ccba0399680a03c2dee83bcae95 < 95920c2ed02bde551ab654e9749c2ca7bc3100e0`
- `Linux c30ae60f41f9edd6e1b5cad41cf28ce04dae39e4`
- `Linux >= 6.12.34 < 6.12.54`
- `Linux >= 6.15.3 < 6.16`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.