CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap()
In the Linux kernel, the following vulnerability has been resolved:
mm: clear uffd-wp PTE/PMD state on mremap()
When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between the vma flags (which have uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp cleared). This mismatch causes a subsequent mprotect(PROTWRITE) to trigger a warning in pagetablecheckpteflags() due to setting the pte to writable while uffd-wp is still set.
Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any such mremap() so that the values are consistent with the existing clearing of VMUFFDWP. Be careful to clear the logical flag regardless of its physical form; a PTE bit, a swap PTE bit, or a PTE marker. Cover PTE, huge PMD and hugetlb paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21696?
CVE-2025-21696 is classified as a low-severity vulnerability in the Linux kernel.
How do I fix CVE-2025-21696?
To resolve CVE-2025-21696, update your Linux kernel to the latest version where this vulnerability has been patched.
What software is affected by CVE-2025-21696?
CVE-2025-21696 affects the Linux kernel across various distributions.
What type of vulnerability is CVE-2025-21696?
CVE-2025-21696 is a memory handling vulnerability related to inconsistent flag clearing during the mremap() operation.
Is CVE-2025-21696 exploitable?
The exploitability of CVE-2025-21696 is considered limited, primarily affecting scenarios involving userfaultfd.