CVE-2025-39899: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
In the Linux kernel, the following vulnerability has been resolved:
mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE
With CONFIGHIGHPTE on 32-bit ARM, movepagespte() maps PTE pages using kmaplocalpage(), which requires unmapping in Last-In-First-Out order.
The current code maps dstpte first, then srcpte, but unmaps them in the same order (dstpte, srcpte), violating the LIFO requirement. This causes the warning in kunmaplocalindexed():
WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmaplocalindexed+0x178/0x17c addr \!= fixtovirt(FIXKMAPBEGIN + idx)
Fix this by reversing the unmap order to respect LIFO ordering.
This issue follows the same pattern as similar fixes: - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order") - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfsrename")
Both of which addressed the same fundamental requirement that kmaplocal operations must follow LIFO ordering.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39899?
CVE-2025-39899 has a medium severity rating due to its impact on memory management in the Linux kernel.
What systems are affected by CVE-2025-39899?
CVE-2025-39899 primarily affects the Linux kernel running on 32-bit ARM architectures with CONFIG_HIGHPTE enabled.
How do I fix CVE-2025-39899?
To resolve CVE-2025-39899, update your Linux kernel to a version that includes the patch addressing the vulnerability.
What type of vulnerability is CVE-2025-39899?
CVE-2025-39899 is a memory management vulnerability related to the Last-In-First-Out ordering requirement of kmap_local_page().
Is CVE-2025-39899 actively exploited?
As of now, there are no known active exploits for CVE-2025-39899, but it is recommended to patch vulnerable systems promptly.