CVE-2025-21696 mm: clear uffd-wp PTE/PMD state on mremap()
A kernel inconsistency in userfaultfd write-protect handling during mremap can trigger a page table check warning, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21696?
CVE-2025-21696 is a medium-severity vulnerability in Linux kernel, published on 12 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: clear uffd-wp PTE/PMD state on mremap()
When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency in flag clearing leads to a mismatch between the vma flags (which have uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp cleared). This mismatch causes a subsequent mprotect(PROT_WRITE) to trigger a warning in page_table_check_pte_flags() due to setting the pte to writable while uffd-wp is still set.
Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any such mremap() so that the values are consistent with the existing clearing of VM_UFFD_WP. Be careful to clear the logical flag regardless of its physical form; a PTE bit, a swap PTE bit, or a PTE marker. Cover PTE, huge PMD and hugetlb paths.
Which versions are affected by CVE-2025-21696?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21696?
Apply the vendor's patch.
Is CVE-2025-21696 being exploited?
There is no known exploitation of CVE-2025-21696 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-56839, BELL-CVE-2025-21696, DEBIAN-CVE-2025-21696, GHSA-6q8c-8rxm-f6fh, ROOT-OS-DEBIAN-11-CVE-2025-21696, ROOT-OS-DEBIAN-12-CVE-2025-21696 and 3 more.