Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - mm/memory-failure: 当 unpoison 内存时修复 VM_BUG_ON_PAGE(PagePoisoned(page)) 当我进行内存故障测试时会发生下面的错误页面转储因为: VM_BUG_ON_PAGE(PagePoisoned(page)) 内核缺陷位于 include/linux/page-flags .h:616! Oops无效的 opcode0000 [#1] PREEMPT SMP NOPTI CPU3 PID720 Comm
    bash 未受感染 6.10.0-rc1-00195-g148743902568 #40 RIP: 0010:unpoison_memory+0x2f3/0x590 RSP
    0018:ffffa57fc8787d60 EFLAGS: 00000246 RAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0 RBP: 0000000000300000 R08:
     R09ffffffffb4956f88  : 0000000000009ffb R10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000 R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe FS: 00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES0000 CR00000000080050033 CR2
    0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0 Call Trace: <TASK> unpoison_memory+0x2f3/0x590 simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110 debugfs_attr_write+0x42/0x60 full_proxy_write+0x5b/0x80 vfs_write+0xd5/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xb9/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f08f0314887 RSP
    002b00007ffece710078 EFLAGS00000246 ORIG_RAX0000000000000001 RAXffffffffffffffda RBX
    0000000000000009 RCX: 00007f08f0314887 RDX: 0000000000000009 RSI: 0000564787a30410 RDI: 0000000000000001 RBP: 0000564787a30410 R08: 000000000000fefe R09: 000000007fffffff R10: 0000000000000000 R11:
    0000000000000246 R120000000000000009 R1300007f08f041b780 R1400007f08f0417600 R15: 00007f08f0416a00 </TASK> Modules 中链接的hwpoison_inject ---[ end trace 000RIP]
    0010unpoison_memory+0x2f3/0x590 RSP0018:ffffa57fc8787d60 EFLAGS00000246 RAX: 0000000000000037 RBX
    0000000000000009 RCX: ffff9be25fcdc9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0 RBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb R10: 0000000000000284 R11:
     R12ffffffffb4926fa0  : ffffe6b00c000000 R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe FS: 00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564787a30410 CR3: 000000010d4e2000 CR400000000000006f0 内核错误 - 不同步致命异常内核偏移0x31c00000 来自 0xffffffff81000000重定位范围
    0xffffffff80000000-0xffffffffbffffffff ---[ 结束内核错误 - 未同步: 致命异常 ]--- 根本原因是 unpoison_memory() 尝试检查未初始化页面的 PG_HWPoison 标记。因此会触发 VM_BUG_ON_PAGE(PagePoisoned(page))。通过以下步骤可以重现此问题1. 离线内存区块: echo离线 > /sys/devices/system/memory/memory12/state 2. 获取离线内存 pfn: page-types -bn
    -rlN 3.Write pfn 至 unpoison-pfn echo <pfn> > /sys/kernel/debug/hwpoison/unpoison-pfn 返回 NULL 的 pfn_to_online_page() 可以识别此情况。而预期永远不会出现 ZONE_DEVICE 页面因此我们可仅在 pfn_to_online_page() == NULL 时失败来修复 缺陷。 (CVE-2025-39883)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-39883

high Nessus 插件 ID 265881

版本 1.20