CVE-2025-39899

What it actually does

Incorrect LIFO ordering in kmap_local calls for userfaultfd under CONFIG_HIGHPTE allows memory corruption through improper high-page-table entry handling during page fault servicing.

Why it matters to the business

Systems running affected kernel versions on high-PTE configurations face elevated risk of local memory corruption that can lead to crashes, data integrity issues, or unauthorized code execution; low exploit probability and no known ransomware use reduce urgency but still require patching of SUSE procps and kernel packages.

How an attack unfolds

An attacker with local access crafts userfaultfd operations that trigger kmap_local mappings in the wrong order on CONFIG_HIGHPTE kernels, corrupting kernel memory structures to achieve privilege escalation or denial of service.

How to fix it

Upgrade procps packages on SUSE Linux Enterprise Desktop 12 SP3, Software Development Kit 12 SP3, Server 12 SP3, and Server for SAP Applications 12 SP3 to version 3.3.9-11.11.1 or later; apply kernel commit b051f707018967ea8f697d790a1ed8c443f63812 or equivalent stable updates.

How to confirm the fix worked

Verify installed procps version is 3.3.9-11.11.1 or newer and confirm kernel source contains the LIFO ordering fix; test userfaultfd workloads on CONFIG_HIGHPTE builds to ensure no ordering violations occur.

Typical attack path

1. Obtain local user access on target system
2. Create userfaultfd file descriptor and register memory ranges
3. Trigger page faults that invoke kmap_local under high-PTE conditions
4. Exploit resulting memory corruption to overwrite kernel structures
5. Escalate privileges or cause system instability

How to detect it

Examine kernel logs and audit records for userfaultfd-related page fault errors or unexpected high-memory mapping failures; no widespread exploitation indicators are known.

What your security team should do

• Prioritize patching SUSE procps and kernel packages within standard maintenance windows given low EPSS and absence from KEV
• Review systems using CONFIG_HIGHPTE for exposure and schedule updates
• Monitor for future EPSS increases or exploit maturity reports