CVE-2025-39899 mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
A kernel bug in userfaultfd handling on 32-bit ARM with HIGHPTE enabled causes a warning and potential instability due to incorrect memory mapping order.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39899?
CVE-2025-39899 is a medium-severity vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order.
The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed():
WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)
Fix this by reversing the unmap order to respect LIFO ordering.
This issue follows the same pattern as similar fixes: - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order") - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")
Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.
Which versions are affected by CVE-2025-39899?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39899?
Apply the vendor's patch.
Is CVE-2025-39899 being exploited?
There is no known exploitation of CVE-2025-39899 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39899, DEBIAN-CVE-2025-39899, GHSA-h283-rr2h-w2jj, ROOT-OS-UBUNTU-2404-CVE-2025-39899, UBUNTU-CVE-2025-39899.