CVE-2025-39903 in Linux
Riassunto
di VulDB • 29/06/2026
Based on the kernel panic log provided, here is an analysis of the crash and potential causes/solutions.
### **1. Summary of the Crash** - **Error Type:** `Internal error: Oops` (Kernel Panic) during early boot (`[ 0.000000]`).
- **CPU Context:** Running on CPU 0, PID 0 (`swapper`), which is the idle kernel thread. This indicates a critical failure in very early initialization code. - **Faulting Function:** `free_area_init+0x50c/0xf9c`. - **Hardware Emulation:** The log explicitly states: ``` Hardware name: linux,dummy-virt (DT) ``` This means you are running on a **QEMU virtual machine** using the default `virt` board, not real hardware.
---
### **2. Root Cause Analysis**
#### **A. The Immediate Fault: Data Abort at Address `0x00000000000000a0`** - The log shows: ``` [ 0.000000] FSC = 0x04: level 0 translation fault
... [ 0.000000] [00000000000000a0] user address but active_mm is swapper
``` - **Translation Fault (FSC=0x04):** The CPU tried to access virtual address `0xa0`, but the page tables were not set up yet, or the mapping was invalid. - **"user address":** This suggests that either: - A kernel pointer was mistakenly interpreted as a user-space address. - Or more likely in early boot: **The MMU is partially enabled**, and `free_area_init` (which initializes memory zones) accessed an unmapped or incorrectly mapped region.
#### **B. Why `free_area_init`?** - `free_area_init()` is called during early kernel initialization to set up the buddy allocator for different memory zones (`ZONE_DMA`, `ZONE_NORMAL`, etc.). - It runs while page tables are being constructed but before full user-space support is enabled. - Accessing address `0xa0` (a very low virtual address) in this context usually means: - **NULL pointer dereference** or offset from a NULL base. - A bug in how memory regions were parsed from the Device Tree (`DT`).
#### **C. Likely Culprit: QEMU `virt` Board + Kernel Version Mismatch** - You are using kernel version `6.17.0-rc1`. This is an **in-development release**. - The combination of a new RC kernel with QEMU's default `virt` machine can sometimes expose regressions in: - Device Tree parsing (`arm64/boot/dts/`). - Memory reservation handling (e.g., reserved-memory nodes). - Early page table setup for the `virt` board.
---
### **3. Recommended Solutions**
#### ✅ **Step 1: Try a Stable Kernel Version** Since you are on an `-rc` kernel, this is likely a known regression or untested code path. - Boot with a stable release (e.g., `6.6 LTS`, `6.9`, or latest stable). - If the crash disappears, it was a bug in 6.17-rc1.
#### ✅ **Step 2: Check Device Tree (`virt.dts`)** The error occurs during memory initialization from DTB. - Ensure your QEMU command line uses a valid device tree. For example: ```bash qemu-system-aarch64 -M virt -cpu cortex-a57 -m 1G \ -kernel Image.gz \ -append "console=ttyAMA0" \ -nographic ``` - If you are using a custom DTB, verify that: - The `memory` node is correctly defined. - There are no overlapping or malformed `reserved-memory` regions.
#### ✅ **Step 3: Disable Early Debug/Features** If this happens on stable kernels too, try disabling features in `.config`: ```bash make menuconfig # Under Kernel hacking -> Compile-time checks and compiler options: [ ] Enable debug kernel code (CONFIG_DEBUG_KERNEL) - *try without*
# Or specifically: [ ] Debug page memory allocations (CONFIG_PAGE_POISONING) - *disable temporarily*
```
#### ✅ **Step 4: Check for Known QEMU/Kernel Bugs** - Search the Linux Kernel Mailing List (LKML) or bugzilla.kernel.org for: `"
If you want to get the best quality for vulnerability data then you always have to consider VulDB.