CVE-2025-39899: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

Published Oct 1, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE

With CONFIGHIGHPTE on 32-bit ARM, movepagespte() maps PTE pages using kmaplocalpage(), which requires unmapping in Last-In-First-Out order.

The current code maps dstpte first, then srcpte, but unmaps them in the same order (dstpte, srcpte), violating the LIFO requirement. This causes the warning in kunmaplocalindexed():

WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmaplocalindexed+0x178/0x17c addr \!= fixtovirt(FIXKMAPBEGIN + idx)

Fix this by reversing the unmap order to respect LIFO ordering.

This issue follows the same pattern as similar fixes: - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order") - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfsrename")

Both of which addressed the same fundamental requirement that kmaplocal operations must follow LIFO ordering.

Affected Software

7 affected components
Linux Linux kernel
Linux Linux kernel>=6.8<6.12.46
Linux Linux kernel>=6.13<6.16.6
Linux Linux kernel=6.17-rc1
Linux Linux kernel=6.17-rc2
Linux Linux kernel=6.17-rc3
Linux Linux kernel=6.17-rc4

Event History

Oct 1, 2025
CVE Published
via MITRE·07:42 AM
Data Sourced
via MITRE·07:42 AM
Description
Data Sourced
via NVD·08:15 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-39899?

CVE-2025-39899 has a medium severity rating due to its impact on memory management in the Linux kernel.

2

What systems are affected by CVE-2025-39899?

CVE-2025-39899 primarily affects the Linux kernel running on 32-bit ARM architectures with CONFIG_HIGHPTE enabled.

3

How do I fix CVE-2025-39899?

To resolve CVE-2025-39899, update your Linux kernel to a version that includes the patch addressing the vulnerability.

4

What type of vulnerability is CVE-2025-39899?

CVE-2025-39899 is a memory management vulnerability related to the Last-In-First-Out ordering requirement of kmap_local_page().

5

Is CVE-2025-39899 actively exploited?

As of now, there are no known active exploits for CVE-2025-39899, but it is recommended to patch vulnerable systems promptly.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203