Inconsistency in Memory Region Management in Linux Kernel - CVE-2025-21696
Summary
CVE-2025-21696: In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap() When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFD_... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system, including memory management, process scheduling, and device control. This vulnerability specifically affects the memory management subsystem, where inconsistencies can arise when using userfaultfd for write-protected memory regions.
Vulnerability Detail
CVE-2025-21696 is a vulnerability in the Linux kernel related to the handling of memory regions that have been registered with userfaultfd as write-protected. When a memory region is remapped using mremap() without the UFFD_FEATURE_EVENT_REMAP feature, the flags for the virtual memory area (vma) and the page table entries (pte/pmd) can become inconsistent. This inconsistency can lead to warnings when attempting to change the memory protection to writable, as the kernel detects a mismatch in the expected state of the memory region. The vulnerability can potentially lead to unexpected behavior in applications relying on proper memory protection mechanisms.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-21696 is a significant vulnerability in the Linux kernel that can lead to inconsistencies in memory management. It is crucial for users to update their systems to the latest patched versions to protect against potential exploitation. Monitoring tools like Vulert can help in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21696 is a vulnerability in the Linux kernel that affects memory management when using userfaultfd for write-protected memory regions.
This vulnerability can cause inconsistencies in memory protection, potentially leading to unexpected behavior in applications that rely on proper memory management.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any installation.
If you are affected, you should update your Linux kernel to the latest patched version as soon as possible to mitigate the vulnerability.
Yes, for Debian 13, you should update to version 6.12.11-1 or later to ensure the vulnerability is patched.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
