CVE-2025-40040

CVE-2025-40040 (Linux kernel) affects the flag-dropping behavior in mm/ksm when madvise() is used on a UFFD-registered VMA. The issue arises from the interaction of VM_MERGEABLE and 32/64-bit width when applying the &= ~VM_MERGEABLE on vm_flags, which can clear the upper 32 bits and trigger a ker...