CVE-2025-39899 mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE With CONFIGHIGHPTE on 32-bit ARM, movepagespte maps PTE pages using kmaplocalpage, which requires unmapping in Last-In-First-Out order. The current code maps dstpte...

CVE-2025-39899

CVE-2025-39899 concerns the Linux kernel mm/userfaultfd path where, on 32-bit ARM with CONFIG_HIGHPTE, move_pages_pte() maps PTE pages using kmap_local_page() and must unmap them in LIFO order. The current code unmapped dst_pte then src_pte in the same sequence, violating LIFO and triggering a ku...