CVE-2025-21696

In the Linux kernel, the following vulnerability has been resolved:

mm: clear uffd-wp PTE/PMD state on mremap()

When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency in flag clearing leads to a mismatch between the vma flags (which have uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp cleared). This mismatch causes a subsequent mprotect(PROT_WRITE) to trigger a warning in page_table_check_pte_flags() due to setting the pte to writable while uffd-wp is still set.

Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any such mremap() so that the values are consistent with the existing clearing of VM_UFFD_WP. Be careful to clear the logical flag regardless of its physical form; a PTE bit, a swap PTE bit, or a PTE marker. Cover PTE, huge PMD and hugetlb paths.

This vulnerability is rated with a Moderate severity for Red Hat Enterprise Linux because exploitation requires local access and is limited to causing a denial of service, with no compromise of data confidentiality or integrity. Triggering the flaw requires a local process to execute a specific sequence of memory remapping and protection operations on regions configured with userfaultfd write tracking. On standard Red Hat Enterprise Linux deployments, access to userfaultfd interfaces is restricted for unprivileged users, substantially limiting exposure under default system configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.