CVE-2025-21696

CVE-2025-21696 (Linux kernel) : Affects memory management with userfaultfd (UFFD). When mremap() moves a region previously registered with UFFD_WP but without UFFD_FEATURE_EVENT_REMAP, the code could fail to clear uffd-wp on PTE/PMD, causing a mismatch between vma flags (UFFD_WP cleared) and PTE/...

CVE-2025-21696 mm: clear uffd-wp PTE/PMD state on mremap()

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

CVE-2025-21696 mm: clear uffd-wp PTE/PMD state on mremap()

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

CVE-2025-21696

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not clearing the uffd-wp PTE/PMD state during the mremap operation. An attacker exploiting this vulnerabilit...

CVE-2025-21696: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

PT-2025-6932

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises when a memory region previously registered with userfaultfd as write-protected but without UFFD FEATURE EVENT REMAP is mremaped, leading to an inconsistency in flag...

SUSE CVE-2024-53111

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr include include include define ADDR1 void0x60000000 define ADDR2 void0x10000000 define SIZE 0x50000000uL int...

CVE-2024-53111

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr oldend to be false-positive if len + oldaddr wraps around. oldaddr is the cursor in the old range up to whic...

CVE-2024-53111

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr include include include define ADDR1 void0x60000000 define ADDR2 void0x10000000 define SIZE 0x50000000uL int...

DEBIAN-CVE-2024-53111

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr include include include define ADDR1 void0x60000000 define ADDR2 void0x10000000 define SIZE 0x50000000uL int...

UBUNTU-CVE-2024-53111

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr include include include define ADDR1 void0x60000000 define ADDR2 void0x10000000 define SIZE 0x50000000uL int...

CVE-2024-53111

The CVE-2024-53111 issue is in the Linux kernel mm/mremap.c: move_page_tables on 32-bit arches, where len + old_addr can wrap and trigger a false positive in the old_end check. This can cause mremap() to report success without moving PTEs, potentially losing contents of anonymous private mappings...

CVE-2024-53111 mm/mremap: fix address wraparound in move_page_tables()

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr include include include define ADDR1 void0x60000000 define ADDR2 void0x10000000 define SIZE 0x50000000uL int...

CVE-2024-53111 mm/mremap: fix address wraparound in move_page_tables()

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr include include include define ADDR1 void0x60000000 define ADDR2 void0x10000000 define SIZE 0x50000000uL int...

CVE-2024-53111: Integer Overflow or Wraparound

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in movepagetables On 32-bit platforms, it is possible for the expression len + oldaddr oldend to be false-positive if len + oldaddr wraps around. oldaddr is the cursor in the old range up to whic...

Linux 6.6 Race Condition Exploit

A security-relevant race between mremap and THP code has been discovered. Reaching the buggy code typically requires the ability to create unprivileged namespaces. The bug leads to installing physical address 0 as a page table, which is likely exploitable in several ways: For example, triggering...

Linux 6.6 Race Condition

Summary I found a security-relevant race between mremap and THP code. Reaching the buggy code typically requires the ability to create unprivileged namespaces. The bug leads to installing physical address 0 as a page table, which is likely exploitable in several ways: For example, triggering the...

PT-2024-35576

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.11.9 Description The issue arises from a false-positive condition in the move page tables function, specifically with the expression len + old addr old end on 32-bit platforms. When len + old addr wraps around,...

CVE-2024-50066

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix movenormalpmd/retractpagetables race In mremap, movepagetables looks at the type of the PMD entry and the specified address range to figure out by which method the next chunk of page table entries should be moved. ...