CVE-2025-21696

What it actually does

Inconsistency between cleared VM_UFFD_WP VMA flags and uncleared uffd-wp bits in PTE/PMD/swap PTE/PTE markers after mremap() on userfaultfd write-protected regions without UFFD_FEATURE_EVENT_REMAP, causing page_table_check_pte_flags() warnings on subsequent mprotect(PROT_WRITE).

Why it matters to the business

Kernel stability issues and unexpected warnings on systems performing memory remapping with userfaultfd write-protection, potentially leading to operational disruptions in containerized or virtualized Linux environments with high memory management activity.

How an attack unfolds

An attacker maps memory, registers it with userfaultfd write-protect, performs mremap() without the remap event feature, then issues mprotect to writable to trigger the flag mismatch and associated page table check warning; related Linux kernel privilege escalation patterns in the same family may chain this inconsistency for further exploitation.

How to fix it

Upgrade the Linux kernel to a version containing commit 310ac886d68de661c3a334198d8604b722d7fdf8 or later stable releases that explicitly clear uffd-wp PTE/PMD/swap/marker state on mremap().

How to confirm the fix worked

Confirm kernel source contains the mremap() uffd-wp clearing logic for PTE, huge PMD and hugetlb paths; test by exercising mremap() followed by mprotect on write-protected userfaultfd regions and verify absence of page_table_check warnings.

Typical attack path

1. Identify process using userfaultfd with write-protection on a memory region
2. Trigger mremap() on the region without UFFD_FEATURE_EVENT_REMAP enabled
3. Issue mprotect(PROT_WRITE) to provoke page table check warning due to uncleared uffd-wp state
4. Leverage resulting kernel state inconsistency for memory corruption or privilege escalation

How to detect it

Review kernel logs for page_table_check_pte_flags warnings following mremap and mprotect sequences on userfaultfd regions; inspect process memory management call traces for mremap on uffd-wp areas.

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all affected Linux distributions and containers
• Monitor EPSS trend for any increase indicating rising exploitability
• Audit workloads using userfaultfd with mremap() for exposure and apply updates before further kernel privilege escalation chains are published