CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap()
In the Linux kernel, the following vulnerability has been resolved:
mm: clear uffd-wp PTE/PMD state on mremap()
When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between the vma flags (which have uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp cleared). This mismatch causes a subsequent mprotect(PROTWRITE) to trigger a warning in pagetablecheckpteflags() due to setting the pte to writable while uffd-wp is still set.
Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any such mremap() so that the values are consistent with the existing clearing of VMUFFDWP. Be careful to clear the logical flag regardless of its physical form; a PTE bit, a swap PTE bit, or a PTE marker. Cover PTE, huge PMD and hugetlb paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.11-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.11 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-azure-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-24.24~24.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1012.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-oem-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1020.20 - Compensating control
On any mremap() of a region previously registered with userfaultfd as write-protected without UFFD_FEATURE_EVENT_REMAP, explicitly clear the uffd-wp PTE/PMD state in all paths, including PTE bits, swap PTE bits, PTE markers, huge PMD, and hugetlb paths, consistently with clearing VM_UFFD_WP.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21696?
CVE-2025-21696 is classified as a low-severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21696?
To resolve CVE-2025-21696, update your Linux kernel to the latest version where this vulnerability has been patched.
What software is affected by CVE-2025-21696?
CVE-2025-21696 affects the Linux kernel across various distributions.
What type of vulnerability is CVE-2025-21696?
CVE-2025-21696 is a memory handling vulnerability related to inconsistent flag clearing during the mremap() operation.
Is CVE-2025-21696 exploitable?
The exploitability of CVE-2025-21696 is considered limited, primarily affecting scenarios involving userfaultfd.