CVE-2025-39775 in Linux
Summary
by MITRE • 09/11/2025
In the Linux kernel, the following vulnerability has been resolved:
mm/mremap: fix WARN with uffd that has remap events disabled
Registering userfaultd on a VMA that spans at least one PMD and then mremap()'ing that VMA can trigger a WARN when recovering from a failed page table move due to a page table allocation error.
The code ends up doing the right thing (recurse, avoiding moving actual page tables), but triggering that WARN is unpleasant:
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline]
WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Modules linked in: CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline]
RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline]
RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Code: ... RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0 Call Trace: <TASK> copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282 mremap_to+0x1b7/0x450 mm/mremap.c:1406 do_mremap+0xfad/0x1f80 mm/mremap.c:1921 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f00d0b8ebe9 Code: ... RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002 R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005 </TASK>
The underlying issue is that we recurse during the original page table move, but not during the recovery move.
Fix it by checking for both VMAs and performing the check before the pmd_none() sanity check.
Add a new helper where we perform+document that check for the PMD and PUD level.
Thanks to Harry for bisecting.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/24/2026
The vulnerability described in CVE-2025-39775 resides within the Linux kernel's memory management subsystem, specifically in the mremap functionality that handles virtual memory area reorganization. This issue manifests when userfaultfd is registered on a virtual memory area (VMA) that spans at least one page middle directory (PMD) and subsequently undergoes mremap operations. The problem arises during page table recovery processes when a page table allocation error occurs, triggering an unwanted kernel warning message that indicates a failed page table move operation. The technical root cause involves inconsistent handling during recursive page table operations where the recovery mechanism fails to properly account for the state of VMAs during the reorganization process.
The vulnerability demonstrates a classic case of improper state management in kernel memory subsystems, where the recovery path does not mirror the behavior of the initial operation path. This inconsistency leads to a false positive warning condition that, while the system ultimately performs the correct operations, creates unnecessary noise in kernel logs and potentially masks more serious underlying issues. The warning trace indicates execution flow through move_normal_pmd, move_pgt_entry, and move_page_tables functions in mm/mremap.c, with specific line numbers pointing to the problematic code sections at 357 and 595. The kernel stack trace shows this occurs during copy_vma_and_data, move_vma, mremap_to, and do_mremap operations, indicating a deep integration with core memory management functions.
This vulnerability impacts system stability by generating spurious warning messages that can clutter kernel logs and potentially interfere with monitoring systems designed to detect genuine kernel issues. From an operational perspective, the vulnerability represents a minor but significant code quality issue that affects the reliability of kernel memory management operations, particularly when userfaultfd is actively used for memory management optimizations. The issue aligns with CWE-691, which addresses insufficient control flow management in security-critical code paths. The improper handling of recursive operations during page table management also relates to ATT&CK technique T1059.001 for kernel-level code execution and T1070.006 for indicator removal through kernel-level log manipulation.
The fix implemented addresses the root cause by ensuring consistent behavior between the original page table move operation and the recovery path. The solution involves adding a new helper function that performs and documents the necessary checks for PMD and PUD levels before the pmd_none() sanity check. This approach ensures that both VMAs are properly checked during the recovery phase, maintaining consistency with the original operation path. The fix specifically targets the mismatch in recursion handling between the initial operation and recovery scenarios, ensuring that the recovery mechanism properly accounts for VMA states during page table moves. This approach aligns with secure coding practices by ensuring consistent state management and proper error handling in kernel memory management operations, preventing unnecessary warnings while maintaining system functionality. The solution prevents the warning from being triggered during legitimate page table recovery operations, thereby reducing false positives in kernel debugging and monitoring systems.