CVE-2025-21851 bpf: Fix softlockup in arena_map_free on 64k page kernel
A soft lockup in the Linux kernel BPF arena map free function on 64k page kernels can cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21851?
CVE-2025-21851 is a high-severity denial of service vulnerability in Linux kernel, published on 12 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix softlockup in arena_map_free on 64k page kernel
On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64.
It turns out arena_map_free() is calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start(). If this address is not page-aligned the code ends up calling apply_to_pte_range() with that unaligned address causing soft lockup.
Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value.
Weakness: CWE-667
Which versions are affected by CVE-2025-21851?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21851?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-21851 being exploited?
There is no known exploitation of CVE-2025-21851 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21851, DEBIAN-CVE-2025-21851, GHSA-hc84-56cx-wr29, UBUNTU-CVE-2025-21851.