CVE-2025-21696

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: clear uffd-wp PTE/PMD state on mremap()

When mremap()ing a memory region previously registered with userfaultfd as

write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency in

flag clearing leads to a mismatch between the vma flags (which have

uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp

cleared). This mismatch causes a subsequent mprotect(PROT_WRITE) to

trigger a warning in page_table_check_pte_flags() due to setting the pte

to writable while uffd-wp is still set.

Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any

such mremap() so that the values are consistent with the existing clearing

of VM_UFFD_WP. Be careful to clear the logical flag regardless of its

physical form; a PTE bit, a swap PTE bit, or a PTE marker. Cover PTE,

huge PMD and hugetlb paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References