CVE-2025-39775
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Sep 11, 2025
CISA due date
—
Cloudanix analysis
A Linux kernel bug can cause confusing warning messages during certain memory-management operations when things go wrong, but it does not let attackers take control of the system.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Theoretical
- Impact
- Other
- Component
- OS kernel
- Class
- Other
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Triggers a kernel WARN during recovery from page table allocation failure in move_page_tables when mremap operates on a VMA spanning at least one PMD that is registered with userfaultfd having remap events disabled; the code recurses correctly but the sanity check is performed too late.
Why it matters to the business
Produces spurious kernel warnings in production logs that can complicate incident response, trigger monitoring alerts, or indicate latent stability issues on systems performing memory remapping with userfaultfd; low immediate risk given absence from KEV and low EPSS.
How an attack unfolds
An attacker or fuzzer registers userfaultfd on a sufficiently large VMA, issues an mremap that crosses PMD boundaries, forces a page-table allocation failure during the move, and observes the resulting WARN in the recovery path; no privilege escalation or data compromise results.
How to fix it
Upgrade the Linux kernel to a version containing commit d70ca21f7bff162a5afae1ddd6f4107adf05ae23; rebuild and reboot affected systems; apply the same fix to any downstream stable trees that have not yet merged it.
How to confirm the fix worked
Confirm the commit is present in the running kernel source or via version string; exercise mremap paths with userfaultfd under allocation-pressure conditions and verify absence of the move_normal_pmd / move_page_tables WARN.
Typical attack path
- Register userfaultfd on a VMA spanning multiple PMDs with remap events disabled
- Issue mremap syscall that triggers page-table move
- Induce page-table allocation failure during the move
- Trigger recovery path that performs the late sanity check and emits WARN
How to detect it
Search kernel logs (dmesg, journalctl, /var/log/kern.log) for the strings "move_normal_pmd", "move_pgt_entry", or "move_page_tables" accompanied by the stack trace containing copy_vma_and_data and mremap_to; correlate with processes using userfaultfd and mremap.
What your security team should do
- Prioritize kernel update on any systems that expose mremap or userfaultfd to untrusted workloads
- Add the WARN signature to kernel log monitoring rules for early detection until patched
- Review application usage of userfaultfd remap events to reduce exposure surface where feasible
The record
In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix WARN with uffd that has remap events disabled Registering userfaultd on a VMA that spans at least one PMD and then mremap()'ing that VMA can trigger a WARN when recovering from a failed page table move due to a page table allocation error. The code ends up doing the right thing (recurse, avoiding moving actual page tables), but triggering that WARN is unpleasant: WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Modules linked in: CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline] RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline] RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Code: ... RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0 Call Trace: <TASK> copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282 mremap_to+0x1b7/0x450 mm/mremap.c:1406 do_mremap+0xfad/0x1f80 mm/mremap.c:1921 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f00d0b8ebe9 Code: ... RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002 R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005 </TASK> The underlying issue is that we recurse during the original page table move, but not during the recovery move. Fix it by checking for both VMAs and performing the check before the pmd_none() sanity check. Add a new helper where we perform+document that check for the PMD and PUD level. Thanks to Harry for bisecting.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | hyperv-daemons-6.12 | 0 | 6.12.60-r2 |
| Chainguard | linux-aws-6.12-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-aws-6.12-fips-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-aws-6.12-headers | 0 | 6.12.60-r1 |
| Chainguard | linux-aws-6.12-modules | 0 | 6.12.58-r0 |
| Chainguard | linux-azure-6.12-boot-installed | 0 | 6.12.60-r0 |
| Chainguard | linux-azure-6.12-fips-boot-installed | 0 | 6.12.60-r1 |
| Chainguard | linux-azure-6.12-headers | 0 | 6.12.60-r2 |
| Chainguard | linux-azure-6.12-modules | 0 | 6.12.58-r1 |
| Chainguard | linux-gcp-6.12-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-fips-boot-installed | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-headers | 0 | 6.12.58-r0 |
| Chainguard | linux-gcp-6.12-modules | 0 | 6.12.58-r0 |
| Chainguard | linux-qemu-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-modules | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12 | 0 | 6.12.67-r0 |
| Chainguard | linux-vmware-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-modules | 0 | 6.12.63-r0 |
| Debian:13 | linux | 0 | No fix |
| Debian:14 | linux | 0 | No fix |
| Linux | Kernel | 6.13.0 | 6.16.4 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.6.1.160000.2.4 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.6.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.6.1 |
Related vulnerabilities
- CVE-2025-39910 In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan… Also affects hyperv-daemons-6.12
- CVE-2025-39925 can: j1939: implement NETDEV_UNREGISTER notification handler Also affects hyperv-daemons-6.12
- CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Also affects hyperv-daemons-6.12
- CVE-2025-39862 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915… Also affects hyperv-daemons-6.12
- CVE-2025-39859 In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix… Also affects hyperv-daemons-6.12
- CVE-2025-39834 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39830 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39833 In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix… Also affects hyperv-daemons-6.12