Skip to content
OpenAdvisories
Unscored CVE-2025-21869 EUVD-2025-8433GHSA-p4m8-c64v-m3v8

powerpc/code-patching: Disable KASAN report during patching via temporary mm

Published Mar 27, 2025 · Updated Nov 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-nvidia Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-xilinx Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/code-patching: Disable KASAN report during patching via temporary mm

Erhard reports the following KASAN hit on Talos II (power9) with kernel 6.13:

[ 12.028126] ==================================================================
[ 12.028198] BUG: KASAN: user-memory-access in copy_to_kernel_nofault+0x8c/0x1a0
[ 12.028260] Write of size 8 at addr 0000187e458f2000 by task systemd/1

[ 12.028346] CPU: 87 UID: 0 PID: 1 Comm: systemd Tainted: G T 6.13.0-P9-dirty #3
[ 12.028408] Tainted: [T]=RANDSTRUCT
[ 12.028446] Hardware name: T2P9D01 REV 1.01 POWER9 0x4e1202 opal:skiboot-bc106a0 PowerNV
[ 12.028500] Call Trace:
[ 12.028536] [c000000008dbf3b0] [c000000001656a48] dump_stack_lvl+0xbc/0x110 (unreliable)
[ 12.028609] [c000000008dbf3f0] [c0000000006e2fc8] print_report+0x6b0/0x708
[ 12.028666] [c000000008dbf4e0] [c0000000006e2454] kasan_report+0x164/0x300
[ 12.028725] [c000000008dbf600] [c0000000006e54d4] kasan_check_range+0x314/0x370
[ 12.028784] [c000000008dbf640] [c0000000006e6310] __kasan_check_write+0x20/0x40
[ 12.028842] [c000000008dbf660] [c000000000578e8c] copy_to_kernel_nofault+0x8c/0x1a0
[ 12.028902] [c000000008dbf6a0] [c0000000000acfe4] __patch_instructions+0x194/0x210
[ 12.028965] [c000000008dbf6e0] [c0000000000ade80] patch_instructions+0x150/0x590
[ 12.029026] [c000000008dbf7c0] [c0000000001159bc] bpf_arch_text_copy+0x6c/0xe0
[ 12.029085] [c000000008dbf800] [c000000000424250] bpf_jit_binary_pack_finalize+0x40/0xc0
[ 12.029147] [c000000008dbf830] [c000000000115dec] bpf_int_jit_compile+0x3bc/0x930
[ 12.029206] [c000000008dbf990] [c000000000423720] bpf_prog_select_runtime+0x1f0/0x280
[ 12.029266] [c000000008dbfa00] [c000000000434b18] bpf_prog_load+0xbb8/0x1370
[ 12.029324] [c000000008dbfb70] [c000000000436ebc] __sys_bpf+0x5ac/0x2e00
[ 12.029379] [c000000008dbfd00] [c00000000043a228] sys_bpf+0x28/0x40
[ 12.029435] [c000000008dbfd20] [c000000000038eb4] system_call_exception+0x334/0x610
[ 12.029497] [c000000008dbfe50] [c00000000000c270] system_call_vectored_common+0xf0/0x280
[ 12.029561] --- interrupt: 3000 at 0x3fff82f5cfa8
[ 12.029608] NIP: 00003fff82f5cfa8 LR: 00003fff82f5cfa8 CTR: 0000000000000000
[ 12.029660] REGS: c000000008dbfe80 TRAP: 3000 Tainted: G T (6.13.0-P9-dirty)
[ 12.029735] MSR: 900000000280f032 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI> CR: 42004848 XER: 00000000
[ 12.029855] IRQMASK: 0
GPR00: 0000000000000169 00003fffdcf789a0 00003fff83067100 0000000000000005
GPR04: 00003fffdcf78a98 0000000000000090 0000000000000000 0000000000000008
GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR12: 0000000000000000 00003fff836ff7e0 c000000000010678 0000000000000000
GPR16: 0000000000000000 0000000000000000 00003fffdcf78f28 00003fffdcf78f90
GPR20: 0000000000000000 0000000000000000 0000000000000000 00003fffdcf78f80
GPR24: 00003fffdcf78f70 00003fffdcf78d10 00003fff835c7239 00003fffdcf78bd8
GPR28: 00003fffdcf78a98 0000000000000000 0000000000000000 000000011f547580
[ 12.030316] NIP [00003fff82f5cfa8] 0x3fff82f5cfa8
[ 12.030361] LR [00003fff82f5cfa8] 0x3fff82f5cfa8
[ 12.030405] --- interrupt: 3000
[ 12.030444] ==================================================================

Commit c28c15b6d28a ("powerpc/code-patching: Use temporary mm for
Radix MMU") is inspired from x86 but unlike x86 is doesn't disable
KASAN reports during patching. This wasn't a problem at the begining
because __patch_mem() is not instrumented.

Commit 465cabc97b42 ("powerpc/code-patching: introduce
patch_instructions()") use copy_to_kernel_nofault() to copy several
instructions at once. But when using temporary mm the destination is
not regular kernel memory but a kind of kernel-like memory located
in user address space.
---truncated---

Affected products

VendorProductAffectedFixed
Linux Linux 6.7 6.12.17

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.12.17-1 —
Debian 13 linux 6.12.17-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux 6.8.0-78.78 USN-7703-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1035.37 USN-7703-1
Ubuntu 24.04 LTS linux-azure 6.8.0-1034.39 USN-7737-1
Ubuntu 24.04 LTS linux-azure-nvidia 6.8.0-1022.23 USN-7737-1
Ubuntu 24.04 LTS linux-gcp 6.8.0-1036.38 USN-7703-2
Ubuntu 24.04 LTS linux-gcp-6.11 +1 6.11.0-1015.15~24.04.1 USN-7521-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1032.36 USN-7703-4
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1019.21 USN-7703-2
Ubuntu 24.04 LTS linux-hwe-6.11 6.11.0-26.26~24.04.1 USN-7521-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1033.33 USN-7703-2
Ubuntu 24.04 LTS linux-intel +4 No fix yet —
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-78.78.1 USN-7703-1
Ubuntu 24.04 LTS linux-lowlatency-hwe-6.11 6.11.0-1014.15~24.04.1 USN-7521-3
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1035.38 USN-7703-4
Ubuntu 24.04 LTS linux-nvidia-6.11 6.11.0-1010.10 —
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1035.38.1 USN-7703-4
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1009.9 —
Ubuntu 24.04 LTS linux-oem-6.11 6.11.0-1022.22 USN-7521-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1032.33 USN-7703-3
Ubuntu 24.04 LTS linux-raspi 6.8.0-1035.39 USN-7703-4
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1017.18 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1035.37~22.04.1 USN-7703-2
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1034.39~22.04.1 USN-7737-1
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1036.38~22.04.1 USN-7703-2
Ubuntu 22.04 LTS linux-hwe-6.8 +1 6.8.0-78.78~22.04.1 USN-7703-4
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1033.33~22.04.1 USN-7703-2
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-78.78.1~22.04.1 USN-7703-1
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1035.38~22.04.1 USN-7703-4
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1032.33~22.04.1 USN-7703-3
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2028.29 USN-7719-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1030.31 USN-7703-1
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1030.31~22.04.1 —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-78.78+fips1 —
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +6 6.4.0-150700.53.3.1 SUSE-SU-2025:01951-1
SLES 15 SP7 kernel-azure +2 6.4.0-150700.20.3.1 SUSE-SU-2025:01967-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.3.1.150700.17.2.1 SUSE-SU-2025:01951-1
SLES 15 SP6 kernel-64kb +3 6.4.0-150600.23.47.2 SUSE-SU-2025:1180-1
SLES 15 SP6 kernel-azure +1 6.4.0-150600.8.34.2 SUSE-SU-2025:1177-1
SLES 15 SP6 kernel-coco +3 6.4.0-15061.21.coco15sp6.1 SUSE-SU-2025:01919-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.47.2.150600.12.20.2 SUSE-SU-2025:1180-1
SLES 15 SP6 kernel-docs +2 6.4.0-150600.23.47.1 SUSE-SU-2025:1180-1
SLES 15 SP6 kernel-syms-azure 6.4.0-150600.8.34.1 SUSE-SU-2025:1177-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 kernel-default-base 6.4.0-28.1.21.6 SUSE-SU-2025:20270-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_6 +1 1-3.1 SUSE-SU-2025:20270-1, SUSE-SU-2025:20260-1
SLE Micro 6.1 kernel-rt +4 6.4.0-28.1 SUSE-SU-2025:20270-1, SUSE-SU-2025:20260-1
SLE Micro 6.0 kernel-default-base 6.4.0-28.1.21.6 SUSE-SU-2025:20192-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_6 +1 1-3.1 SUSE-SU-2025:20192-1, SUSE-SU-2025:20190-1
SLE Micro 6.0 kernel-rt +4 6.4.0-28.1 SUSE-SU-2025:20192-1, SUSE-SU-2025:20190-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.3.1 SUSE-SU-2025:01951-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_1 1-150700.15.3.1 SUSE-SU-2025:01951-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.47.2 SUSE-SU-2025:1180-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_10 1-150600.1.5.1 SUSE-SU-2025:1178-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_10 1-150600.13.5.1 SUSE-SU-2025:1180-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.34.1 SUSE-SU-2025:1178-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +4 6.4.0-150600.23.47.1 SUSE-SU-2025:1180-1
openSUSE Leap 15.6 kernel-64kb +5 6.4.0-150600.23.47.2 SUSE-SU-2025:1180-1
openSUSE Leap 15.6 kernel-azure +1 6.4.0-150600.8.34.2 SUSE-SU-2025:1177-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.47.2.150600.12.20.2 SUSE-SU-2025:1180-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.34.1 SUSE-SU-2025:1178-1
openSUSE Leap 15.6 kernel-syms-azure 6.4.0-150600.8.34.1 SUSE-SU-2025:1177-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-101.33.4.3.el10uek ELSA-2025-20530, ELSA-2025-20480

Advisories 22

References