CVE-2025-39899: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-01 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order. The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed(): WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx) Fix this by reversing the unmap order to respect LIFO ordering. This issue follows the same pattern as similar fixes: - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order") - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename") Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.

Affected products

Linux kernel: from 6.8 before 6.12.46; from 6.13 before 6.16.6; 6.17-rc1, 6.17-rc2, 6.17-rc3, 6.17-rc4 — fixed in 6.12.46, 6.16.6

How to fix

Upgrade to a fixed version: Linux kernel 6.12.46, 6.16.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-39899 or the next vulnerability affects your stack