CVE-2025-39899

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order.

The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed():

WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c addr != __fix_to_virt(FIX_KMAP_BEGIN + idx)

Fix this by reversing the unmap order to respect LIFO ordering.

This issue follows the same pattern as similar fixes:

• commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
• commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")

Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.

The patch fixes a kmap_local()/kunmap_local() ordering bug in userfaultfd’s UFFDIO_MOVE path on 32-bit highmem systems (e.g., ARM with CONFIG_HIGHPTE): PTE pages were unmapped not in LIFO order, triggering kunmap_local_indexed() warnings and risking unstable behavior during page-table moves. Impact is primarily local DoS / kernel instability (WARN splats and potential fault in rare nested-map sequences), and it’s only triggerable on configurations with CONFIG_HIGHPTE and userfaultfd enabled (often further gated by sysctl/policy). Requires local code execution, specific config (32-bit highmem), and use of UFFDIO_MOVE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.