Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-21881— uprobes: Reject the shared zeropage in uprobe_write_opcode()

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于uprobes未拒绝共享零页，可能导致页面状态错误。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.21% · P10 Updated May 13, 2026

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 12

Vendor	Product	Version Range	Status
Linux	Linux	`2b144498350860b6ee9dc57ff27a93ad488de5dc< c4cb2bfa99513311886c1eb5c1c2ac26f3338a6e`	affected
		`2b144498350860b6ee9dc57ff27a93ad488de5dc< 0b6f19714588cf2366b0364234f97ba963688f63`	affected
		`2b144498350860b6ee9dc57ff27a93ad488de5dc< 13cca2b73e2b0ec3ea6d6615d615395621d22752`	affected
		`2b144498350860b6ee9dc57ff27a93ad488de5dc< 54011fc94422f094eaf47555284de70a4bc32bb9`	affected
		`2b144498350860b6ee9dc57ff27a93ad488de5dc< bddf10d26e6e5114e7415a0e442ec6f51a559468`	affected
		`3.5`	affected
		`< 3.5`	unaffected
		`6.1.130≤ 6.1.*`	unaffected
… +4 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21881

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

uprobes: Reject the shared zeropage in uprobe_write_opcode()

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: uprobes: Reject the shared zeropage in uprobe_write_opcode() We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ]

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于uprobes未拒绝共享零页，可能导致页面状态错误。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	2b144498350860b6ee9dc57ff27a93ad488de5dc ~ c4cb2bfa99513311886c1eb5c1c2ac26f3338a6e	-
Linux	Linux	3.5	-

II. Public POCs for CVE-2025-21881

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-21881

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21881 (5)

https://www.cve.org/CVERecord?id=CVE-2025-21881

Same Patch Batch · Linux · 2025-03-27 · 124 CVEs total

CVE-2023-53006	9.8 CRITICAL	cifs: Fix oops due to uncleared server->smbd_conn in reconnect
CVE-2025-21876	8.8 HIGH	iommu/vt-d: Fix suspicious RCU usage
CVE-2025-21890	8.2 HIGH	idpf: fix checksums set in idpf_rx_rsc()
CVE-2025-21887	7.8 HIGH	ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
CVE-2023-53033	7.8 HIGH	netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
CVE-2025-21889	7.8 HIGH	perf/core: Add RCU read lock protection to perf_iterate_ctx()
CVE-2023-52930	7.8 HIGH	drm/i915: Fix potential bit_17 double-free
CVE-2023-52931	7.8 HIGH	drm/i915: Avoid potential vm use-after-free
CVE-2023-52934	7.8 HIGH	mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups
CVE-2023-52935	7.8 HIGH	mm/khugepaged: fix ->anon_vma race
CVE-2023-53009	7.8 HIGH	drm/amdkfd: Add sync after creating vram bo
CVE-2023-52999	7.8 HIGH	net: fix UaF in netns ops registration error path
CVE-2023-52973	7.8 HIGH	vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
CVE-2023-52983	7.8 HIGH	block, bfq: fix uaf for bfqq in bic_set_bfqq()
CVE-2023-52981	7.8 HIGH	drm/i915: Fix request ref counting during error capture & debugfs dump
CVE-2023-52975	7.8 HIGH	scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
CVE-2023-52974	7.8 HIGH	scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
CVE-2022-49760	7.8 HIGH	mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
CVE-2025-21867	7.8 HIGH	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
CVE-2023-52988	7.8 HIGH	ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()

Showing top 20 of 124 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux