#VU107774 Resource management error in Linux kernel - CVE-2025-22090

Vulnerability identifier: #VU107774

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22090

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the copy_page_range() function in mm/memory.c, within the vm_area_dup() function in kernel/fork.c, within the get_pat_info() and untrack_pfn() functions in arch/x86/mm/pat/memtype.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.14, 6.14.1

---

External links
https://git.kernel.org/stable/c/8d6373f83f367dbed316ddeb178130a3a64b5b67
https://git.kernel.org/stable/c/b07398e8a5da517083f5c3f2daa8f6681b48ab28
https://git.kernel.org/stable/c/da381c33f3aa6406406c9fdf07b8b0b63e0ce722
https://git.kernel.org/stable/c/dc84bc2aba85a1508f04a936f9f9a15f64ebfb31
https://git.kernel.org/stable/c/de6185b8892d88142ef69768fe4077cbf40109c0
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.2

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.