CVE-2025-38364maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set. This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations. The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption. User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least)
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Not yet received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa before d69cd64bd5af41c6fd409313504089970edaf02f; from 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa before e63032e66bca1d06e600033f3369ba3db3af0870; from 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa before cf95f8426f889949b738f51ffcd72884411f3a6a; 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa builds before 9e32f4700867abbd5d19abfcf698dbd0d2ce36a4; from 54a611b605901c7d5d05b6b8f5d04a6ceb0962aa before fba46a5d83ca8decb338722fb4899026d8d9ead2 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
References
- https://git.kernel.org/stable/c/d69cd64bd5af41c6fd409313504089970edaf02f
- https://git.kernel.org/stable/c/e63032e66bca1d06e600033f3369ba3db3af0870
- https://git.kernel.org/stable/c/cf95f8426f889949b738f51ffcd72884411f3a6a
- https://git.kernel.org/stable/c/9e32f4700867abbd5d19abfcf698dbd0d2ce36a4
- https://git.kernel.org/stable/c/fba46a5d83ca8decb338722fb4899026d8d9ead2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.