Linux Kernel Memory Management Inconsistency in Userfaultfd Implementation

CVE-2025-21696

Summary

A vulnerability exists in the Linux kernel's handling of memory management, specifically during the mremap() system call for memory regions registered with userfaultfd. An inconsistency arises when the uffd-wp (userfaultfd write-protection) flag is not properly cleared in the page table entries (PTE) and page middle directories (PMD) after a memory remapping operation. This mismatch can lead to erroneous behaviors, such as inappropriate settings of writable permissions, resulting in warnings in page_table_check_pte_flags(). To mitigate this issue, it's crucial that the kernel consistently clears the uffd-wp flags, ensuring alignment between the virtual memory area (VMA) flags and the PTE/PMD flags across all relevant paths, including PTE, huge PMD, and hugetlb implementations.

References