CVE-2025-21709

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21709", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.752Z", "datePublished": "2025-02-27T02:07:22.452Z", "dateUpdated": "2026-10-15T21:51:52.263Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:48.428Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel: be more careful about dup_mmap() failures and uprobe registering\n\nIf a memory allocation fails during dup_mmap(), the maple tree can be left\nin an unsafe state for other iterators besides the exit path. All the\nlocks are dropped before the exit_mmap() call (in mm/mmap.c), but the\nincomplete mm_struct can be reached through (at least) the rmap finding\nthe vmas which have a pointer back to the mm_struct.\n\nUp to this point, there have been no issues with being able to find an\nmm_struct that was only partially initialised. Syzbot was able to make\nthe incomplete mm_struct fail with recent forking changes, so it has been\nproven unsafe to use the mm_struct that hasn't been initialised, as\nreferenced in the link below.\n\nAlthough 8ac662f5da19f (\"fork: avoid inappropriate uprobe access to\ninvalid mm\") fixed the uprobe access, it does not completely remove the\nrace.\n\nThis patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the\noom side (even though this is extremely unlikely to be selected as an oom\nvictim in the race window), and sets MMF_UNSTABLE to avoid other potential\nusers from using a partially initialised mm_struct.\n\nWhen registering vmas for uprobe, skip the vmas in an mm that is marked\nunstable. Modifying a vma in an unstable mm may cause issues if the mm\nisn't fully initialised."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The corrupted mm_struct is produced by the fork()/clone() syscall path (dup_mmap()), which requires local execution on the target system. There is no remote or adjacent-network path to dup_mmap().\nAC:L - The attacker deterministically creates the unsafe mm by forking a process with many VMAs and delivering SIGKILL mid-dup_mmap() (the fatal_signal_pending() bail-out), or by forcing -ENOMEM under a memcg/RLIMIT_AS/overcommit limit, and can repeat this continuously to widen the window; the same attacker-generated memory pressure simultaneously activates the OOM killer/reaper that iterates the broken tree, so both sides of the race are attacker-driven.\nPR:L - Only the ability to call fork()/clone() and allocate memory is needed \u2014 any unprivileged local user or container process qualifies. No capability, namespace, or tracing privilege is required on the attacker's side.\nUI:N - The attacker triggers the failed fork and the resulting corrupted mm_struct entirely on their own; no victim action is required. The consuming iterators (uprobe registration, swapoff, OOM reaper) are background/system activity, not user interaction.\nS:U - The corruption and its consequences are confined to the kernel's own memory-management structures within the same security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The partially-initialised mm's maple tree hands out an internal XA_ZERO_ENTRY (0x406) as a struct vm_area_struct * and, past that point, live pointers to the parent process's VMAs, so iterators read through invalid pointers and operate with mm != vma->vm_mm \u2014 a cross-address-space mismatch that lets page-table walks touch another process's memory; a sibling CLONE_VM thread munmap()ing during the unlocked window turns those entries into dangling freed-object pointers, giving a use-after-free read primitive.\nI:H - install_breakpoint()/uprobe_write_opcode() modifies VMAs and page tables of an mm that is not fully initialised (exactly what the fix's check_stable_address_space() gate prevents), and the OOM reaper path guarded by the new MMF_OOM_SKIP would unmap the parent's VMAs through the child's mmu_gather, flushing the wrong mm's TLB and leaving stale writable mappings to freed pages \u2014 memory corruption usable for arbitrary write.\nA:H - The demonstrated failure is a kernel OOPS dereferencing XA_ZERO_ENTRY at a low address (the sibling swapoff fix records a fault at 0x446), fatal with panic_on_oops; in register_for_each_vma() the oops occurs while holding mmap_write_lock(mm) and percpu_down_write(&dup_mmap_sem), which are never released, hanging every subsequent fork() on the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/uprobes.c", "kernel/fork.c"], "versions": [{"version": "d2406291483775ecddaee929231a39c70c08fda2", "lessThan": "74c2471eb891a7dcb3874b21c106cda75f52be30", "status": "affected", "versionType": "git"}, {"version": "d2406291483775ecddaee929231a39c70c08fda2", "lessThan": "da139948aeda677ac09cc0e7d837f8a314de7d55", "status": "affected", "versionType": "git"}, {"version": "d2406291483775ecddaee929231a39c70c08fda2", "lessThan": "64c37e134b120fb462fb4a80694bfb8e7be77b14", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/uprobes.c", "kernel/fork.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.13.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/74c2471eb891a7dcb3874b21c106cda75f52be30"}, {"url": "https://git.kernel.org/stable/c/da139948aeda677ac09cc0e7d837f8a314de7d55"}, {"url": "https://git.kernel.org/stable/c/64c37e134b120fb462fb4a80694bfb8e7be77b14"}], "title": "kernel: be more careful about dup_mmap() failures and uprobe registering", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21709", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:41.994494Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:52.263Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21709", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:41.994494Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:42:42.867Z"}}], "cna": {"title": "kernel: be more careful about dup_mmap() failures and uprobe registering", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The corrupted mm_struct is produced by the fork()/clone() syscall path (dup_mmap()), which requires local execution on the target system. There is no remote or adjacent-network path to dup_mmap().\nAC:L - The attacker deterministically creates the unsafe mm by forking a process with many VMAs and delivering SIGKILL mid-dup_mmap() (the fatal_signal_pending() bail-out), or by forcing -ENOMEM under a memcg/RLIMIT_AS/overcommit limit, and can repeat this continuously to widen the window; the same attacker-generated memory pressure simultaneously activates the OOM killer/reaper that iterates the broken tree, so both sides of the race are attacker-driven.\nPR:L - Only the ability to call fork()/clone() and allocate memory is needed \u2014 any unprivileged local user or container process qualifies. No capability, namespace, or tracing privilege is required on the attacker's side.\nUI:N - The attacker triggers the failed fork and the resulting corrupted mm_struct entirely on their own; no victim action is required. The consuming iterators (uprobe registration, swapoff, OOM reaper) are background/system activity, not user interaction.\nS:U - The corruption and its consequences are confined to the kernel's own memory-management structures within the same security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The partially-initialised mm's maple tree hands out an internal XA_ZERO_ENTRY (0x406) as a struct vm_area_struct * and, past that point, live pointers to the parent process's VMAs, so iterators read through invalid pointers and operate with mm != vma->vm_mm \u2014 a cross-address-space mismatch that lets page-table walks touch another process's memory; a sibling CLONE_VM thread munmap()ing during the unlocked window turns those entries into dangling freed-object pointers, giving a use-after-free read primitive.\nI:H - install_breakpoint()/uprobe_write_opcode() modifies VMAs and page tables of an mm that is not fully initialised (exactly what the fix's check_stable_address_space() gate prevents), and the OOM reaper path guarded by the new MMF_OOM_SKIP would unmap the parent's VMAs through the child's mmu_gather, flushing the wrong mm's TLB and leaving stale writable mappings to freed pages \u2014 memory corruption usable for arbitrary write.\nA:H - The demonstrated failure is a kernel OOPS dereferencing XA_ZERO_ENTRY at a low address (the sibling swapoff fix records a fault at 0x446), fatal with panic_on_oops; in register_for_each_vma() the oops occurs while holding mmap_write_lock(mm) and percpu_down_write(&dup_mmap_sem), which are never released, hanging every subsequent fork() on the system."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d2406291483775ecddaee929231a39c70c08fda2", "lessThan": "74c2471eb891a7dcb3874b21c106cda75f52be30", "versionType": "git"}, {"status": "affected", "version": "d2406291483775ecddaee929231a39c70c08fda2", "lessThan": "da139948aeda677ac09cc0e7d837f8a314de7d55", "versionType": "git"}, {"status": "affected", "version": "d2406291483775ecddaee929231a39c70c08fda2", "lessThan": "64c37e134b120fb462fb4a80694bfb8e7be77b14", "versionType": "git"}], "programFiles": ["kernel/events/uprobes.c", "kernel/fork.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.2", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/events/uprobes.c", "kernel/fork.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/74c2471eb891a7dcb3874b21c106cda75f52be30"}, {"url": "https://git.kernel.org/stable/c/da139948aeda677ac09cc0e7d837f8a314de7d55"}, {"url": "https://git.kernel.org/stable/c/64c37e134b120fb462fb4a80694bfb8e7be77b14"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel: be more careful about dup_mmap() failures and uprobe registering\n\nIf a memory allocation fails during dup_mmap(), the maple tree can be left\nin an unsafe state for other iterators besides the exit path. All the\nlocks are dropped before the exit_mmap() call (in mm/mmap.c), but the\nincomplete mm_struct can be reached through (at least) the rmap finding\nthe vmas which have a pointer back to the mm_struct.\n\nUp to this point, there have been no issues with being able to find an\nmm_struct that was only partially initialised. Syzbot was able to make\nthe incomplete mm_struct fail with recent forking changes, so it has been\nproven unsafe to use the mm_struct that hasn't been initialised, as\nreferenced in the link below.\n\nAlthough 8ac662f5da19f (\"fork: avoid inappropriate uprobe access to\ninvalid mm\") fixed the uprobe access, it does not completely remove the\nrace.\n\nThis patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the\noom side (even though this is extremely unlikely to be selected as an oom\nvictim in the race window), and sets MMF_UNSTABLE to avoid other potential\nusers from using a partially initialised mm_struct.\n\nWhen registering vmas for uprobe, skip the vmas in an mm that is marked\nunstable. Modifying a vma in an unstable mm may cause issues if the mm\nisn't fully initialised."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:53:48.428Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21709", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:52.263Z", "dateReserved": "2024-12-29T08:45:45.752Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-27T02:07:22.452Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/events/uprobes.c", "kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "74c2471eb891a7dcb3874b21c106cda75f52be30", "status": "affected", "version": "d2406291483775ecddaee929231a39c70c08fda2", "versionType": "git"}, {"lessThan": "da139948aeda677ac09cc0e7d837f8a314de7d55", "status": "affected", "version": "d2406291483775ecddaee929231a39c70c08fda2", "versionType": "git"}, {"lessThan": "64c37e134b120fb462fb4a80694bfb8e7be77b14", "status": "affected", "version": "d2406291483775ecddaee929231a39c70c08fda2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/events/uprobes.c", "kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "869EE8B9-4A29-4120-BAE6-A8581FDD5719", "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel: be more careful about dup_mmap() failures and uprobe registering\n\nIf a memory allocation fails during dup_mmap(), the maple tree can be left\nin an unsafe state for other iterators besides the exit path. All the\nlocks are dropped before the exit_mmap() call (in mm/mmap.c), but the\nincomplete mm_struct can be reached through (at least) the rmap finding\nthe vmas which have a pointer back to the mm_struct.\n\nUp to this point, there have been no issues with being able to find an\nmm_struct that was only partially initialised. Syzbot was able to make\nthe incomplete mm_struct fail with recent forking changes, so it has been\nproven unsafe to use the mm_struct that hasn't been initialised, as\nreferenced in the link below.\n\nAlthough 8ac662f5da19f (\"fork: avoid inappropriate uprobe access to\ninvalid mm\") fixed the uprobe access, it does not completely remove the\nrace.\n\nThis patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the\noom side (even though this is extremely unlikely to be selected as an oom\nvictim in the race window), and sets MMF_UNSTABLE to avoid other potential\nusers from using a partially initialised mm_struct.\n\nWhen registering vmas for uprobe, skip the vmas in an mm that is marked\nunstable. Modifying a vma in an unstable mm may cause issues if the mm\nisn't fully initialised."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kernel: tenga m\u00e1s cuidado con los fallos de dup_mmap() y el registro de uprobe Si una asignaci\u00f3n de memoria falla durante dup_mmap(), el \u00e1rbol de maple puede quedar en un estado inseguro para otros iteradores adem\u00e1s de la ruta de salida. Todos los bloqueos se eliminan antes de la llamada a exit_mmap() (en mm/mmap.c), pero se puede llegar al mm_struct incompleto a trav\u00e9s de (al menos) el rmap que encuentra los vmas que tienen un puntero de vuelta al mm_struct. Hasta este punto, no ha habido problemas para poder encontrar un mm_struct que solo se haya inicializado parcialmente. Syzbot pudo hacer que el mm_struct incompleto fallara con los cambios de bifurcaci\u00f3n recientes, por lo que se ha demostrado que no es seguro usar el mm_struct que no se ha inicializado, como se hace referencia en el enlace a continuaci\u00f3n. Aunque 8ac662f5da19f (\"fork: avoid inappropriate uprobe access to invalid mm\") solucion\u00f3 el acceso a uprobe, no elimina por completo la carrera. Este parche establece MMF_OOM_SKIP para evitar la iteraci\u00f3n de las vmas en el lado oom (aunque es extremadamente improbable que se seleccione como v\u00edctima de oom en la ventana de carrera), y establece MMF_UNSTABLE para evitar que otros usuarios potenciales utilicen una mm_struct parcialmente inicializada. Al registrar vmas para uprobe, omite las vmas en un mm que est\u00e9 marcado como inestable. Modificar una vma en un mm inestable puede causar problemas si el mm no est\u00e1 completamente inicializado."}], "id": "CVE-2025-21709", "lastModified": "2026-10-15T22:18:07.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21709", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:42:41.994494Z", "version": "2.0.3"}}]}, "published": "2025-02-27T02:15:14.560", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/64c37e134b120fb462fb4a80694bfb8e7be77b14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74c2471eb891a7dcb3874b21c106cda75f52be30"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/da139948aeda677ac09cc0e7d837f8a314de7d55"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: kernel: be more careful about dup_mmap() failures and uprobe registering", "id": "2348549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348549"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-457", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nkernel: be more careful about dup_mmap() failures and uprobe registering\nIf a memory allocation fails during dup_mmap(), the maple tree can be left\nin an unsafe state for other iterators besides the exit path. All the\nlocks are dropped before the exit_mmap() call (in mm/mmap.c), but the\nincomplete mm_struct can be reached through (at least) the rmap finding\nthe vmas which have a pointer back to the mm_struct.\nUp to this point, there have been no issues with being able to find an\nmm_struct that was only partially initialised. Syzbot was able to make\nthe incomplete mm_struct fail with recent forking changes, so it has been\nproven unsafe to use the mm_struct that hasn't been initialised, as\nreferenced in the link below.\nAlthough 8ac662f5da19f (\"fork: avoid inappropriate uprobe access to\ninvalid mm\") fixed the uprobe access, it does not completely remove the\nrace.\nThis patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the\noom side (even though this is extremely unlikely to be selected as an oom\nvictim in the race window), and sets MMF_UNSTABLE to avoid other potential\nusers from using a partially initialised mm_struct.\nWhen registering vmas for uprobe, skip the vmas in an mm that is marked\nunstable. Modifying a vma in an unstable mm may cause issues if the mm\nisn't fully initialised."], "name": "CVE-2025-21709", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21709\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21709\nhttps://lore.kernel.org/linux-cve-announce/2025022643-CVE-2025-21709-e967@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2026-05-01T15:15:20.850013+00:00", "updated": "2026-08-04T09:15:03.489861+00:00", "vendors": []}