CVE-2025-39775— mm/mremap: fix WARN with uffd that has remap events disabled
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mremap操作时未正确处理用户态页面错误处理程序，可能导致警告信息触发。
Possible ATT&CK Techniques 1 AI
T1055 · Process InjectionAffected Version Matrix 11
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 310ac886d68de661c3a334198d8604b722d7fdf8< 1c15b4cd3a97aea013bdb18d9a55ca0384fbb8d4 |
affected |
0cef0bb836e3cfe00f08f9606c72abd72fe78ca3< d70ca21f7bff162a5afae1ddd6f4107adf05ae23 |
affected | ||
0cef0bb836e3cfe00f08f9606c72abd72fe78ca3< 772e5b4a5e8360743645b9a466842d16092c4f94 |
affected | ||
8e2f6ba256dd1e590addc48e6e9577bf39c482f2 |
affected | ||
6.12.11< 6.12.114 |
affected | ||
6.6.160< 6.7 |
affected | ||
6.13 |
affected | ||
< 6.13 |
unaffected | ||
| … +3 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-39775
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
mm/mremap: fix WARN with uffd that has remap events disabled
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
mm/mremap: fix WARN with uffd that has remap events disabled
Registering userfaultd on a VMA that spans at least one PMD and then
mremap()'ing that VMA can trigger a WARN when recovering from a failed
page table move due to a page table allocation error.
The code ends up doing the right thing (recurse, avoiding moving actual
page tables), but triggering that WARN is unpleasant:
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852
Modules linked in:
CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline]
RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline]
RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852
Code: ...
RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645
RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007
RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000
FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0
Call Trace:
<TASK>
copy_vma_and_data+0x468/0x790 mm/mremap.c:1215
move_vma+0x548/0x1780 mm/mremap.c:1282
mremap_to+0x1b7/0x450 mm/mremap.c:1406
do_mremap+0xfad/0x1f80 mm/mremap.c:1921
__do_sys_mremap+0x119/0x170 mm/mremap.c:1977
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00d0b8ebe9
Code: ...
RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019
RAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9
RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000
RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005
</TASK>
The underlying issue is that we recurse during the original page table
move, but not during the recovery move.
Fix it by checking for both VMAs and performing the check before the
pmd_none() sanity check.
Add a new helper where we perform+document that check for the PMD and PUD
level.
Thanks to Harry for bisecting.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mremap操作时未正确处理用户态页面错误处理程序，可能导致警告信息触发。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39775
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39775
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-39775 (1)
Same Patch Batch · Linux · 2025-09-11 · 54 CVEs total
| CVE-2025-39758 | 9.8 CRITICAL | RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages |
| CVE-2025-39761 | 8.8 HIGH | wifi: ath12k: Decrement TID on RX peer frag setup error handling |
| CVE-2025-39750 | 8.8 HIGH | wifi: ath12k: Correct tid cleanup when tid setup fails |
| CVE-2025-39790 | 8.4 HIGH | bus: mhi: host: Detect events pointing to unexpected TREs |
| CVE-2025-39779 | 7.8 HIGH | btrfs: subpage: keep TOWRITE tag until folio is cleaned |
| CVE-2025-39785 | 7.8 HIGH | drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local |
| CVE-2025-39786 | 7.8 HIGH | iio: adc: ad7173: fix channels index for syscalib_mode |
| CVE-2025-39787 | 7.8 HIGH | soc: qcom: mdt_loader: Ensure we don't read past the ELF header |
| CVE-2025-39740 | 7.8 HIGH | drm/xe/migrate: prevent potential UAF |
| CVE-2025-39780 | 7.8 HIGH | sched/ext: Fix invalid task state transitions on class switch |
| CVE-2025-39791 | 7.8 HIGH | dm: dm-crypt: Do not partially accept write BIOs with zoned targets |
| CVE-2025-39770 | 7.5 HIGH | net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM |
| CVE-2025-39738 | 7.3 HIGH | btrfs: do not allow relocation of partially dropped subvolumes |
| CVE-2025-39789 | 7.3 HIGH | crypto: x86/aegis - Add missing error checks |
| CVE-2025-39776 | 7.0 HIGH | mm/debug_vm_pgtable: clear page table entries at destroy_args() |
| CVE-2025-39769 | bnxt_en: Fix lockdep warning during rmmod | |
| CVE-2025-39771 | regulator: pca9450: Use devm_register_sys_off_handler | |
| CVE-2025-39782 | jbd2: prevent softlockup in jbd2_log_do_checkpoint() | |
| CVE-2025-39784 | PCI: Fix link speed calculation on retrain failure | |
| CVE-2025-39783 | PCI: endpoint: Fix configfs group list head handling |
Showing top 20 of 54 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2025-39775
No comments yet