{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21932", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.789Z", "datePublished": "2025-04-01T15:41:01.792Z", "dateUpdated": "2026-08-05T11:55:26.135Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:26.135Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: abort vma_modify() on merge out of memory failure\n\nThe remainder of vma_modify() relies upon the vmg state remaining pristine\nafter a merge attempt.\n\nUsually this is the case, however in the one edge case scenario of a merge\nattempt failing not due to the specified range being unmergeable, but\nrather due to an out of memory error arising when attempting to commit the\nmerge, this assumption becomes untrue.\n\nThis results in vmg->start, end being modified, and thus the proceeding\nattempts to split the VMA will be done with invalid start/end values.\n\nThankfully, it is likely practically impossible for us to hit this in\nreality, as it would require a maple tree node pre-allocation failure that\nwould likely never happen due to it being 'too small to fail', i.e. the\nkernel would simply keep retrying reclaim until it succeeded.\n\nHowever, this scenario remains theoretically possible, and what we are\ndoing here is wrong so we must correct it.\n\nThe safest option is, when this scenario occurs, to simply give up the\noperation. If we cannot allocate memory to merge, then we cannot allocate\nmemory to split either (perhaps moreso!).\n\nAny scenario where this would be happening would be under very extreme\n(likely fatal) memory pressure, so it's best we give up early.\n\nSo there is no doubt it is appropriate to simply bail out in this\nscenario.\n\nHowever, in general we must if at all possible never assume VMG state is\nstable after a merge attempt, since merge operations update VMG fields. \nAs a result, additionally also make this clear by storing start, end in\nlocal variables.\n\nThe issue was reported originally by syzkaller, and by Brad Spengler (via\nan off-list discussion), and in both instances it manifested as a\ntriggering of the assert:\n\n\tVM_WARN_ON_VMG(start >= end, vmg);\n\nIn vma_merge_existing_range().\n\nIt seems at least one scenario in which this is occurring is one in which\nthe merge being attempted is due to an madvise() across multiple VMAs\nwhich looks like this:\n\n start end\n |<------>|\n |----------|------|\n | vma | next |\n |----------|------|\n\nWhen madvise_walk_vmas() is invoked, we first find vma in the above\n(determining prev to be equal to vma as we are offset into vma), and then\nenter the loop.\n\nWe determine the end of vma that forms part of the range we are\nmadvise()'ing by setting 'tmp' to this value:\n\n\t\t/* Here vma->vm_start <= start < (end|vma->vm_end) */\n\t\ttmp = vma->vm_end;\n\nWe then invoke the madvise() operation via visit(), letting prev get\nupdated to point to vma as part of the operation:\n\n\t\t/* Here vma->vm_start <= start < tmp <= (end|vma->vm_end). */\n\t\terror = visit(vma, &prev, start, tmp, arg);\n\nWhere the visit() function pointer in this instance is\nmadvise_vma_behavior().\n\nAs observed in syzkaller reports, it is ultimately madvise_update_vma()\nthat is invoked, calling vma_modify_flags_name() and vma_modify() in turn.\n\nThen, in vma_modify(), we attempt the merge:\n\n\tmerged = vma_merge_existing_range(vmg);\n\tif (merged)\n\t\treturn merged;\n\nWe invoke this with vmg->start, end set to start, tmp as such:\n\n start tmp\n |<--->|\n |----------|------|\n | vma | next |\n |----------|------|\n\nWe find ourselves in the merge right scenario, but the one in which we\ncannot remove the middle (we are offset into vma).\n\nHere we have a special case where vmg->start, end get set to perhaps\nunintuitive values - we intended to shrink the middle VMA and expand the\nnext.\n\nThis means vmg->start, end are set to... vma->vm_start, start.\n\nNow the commit_merge() fails, and vmg->start, end are left like this. \nThis means we return to the rest of vma_modify() with vmg->start, end\n(here denoted as start', end') set as:\n\n start' end'\n |<-->|\n |----------|------|\n | vma | next |\n |----------|------|\n\nSo we now erroneously try to split accordingly. This is where the\nunfortunate\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - `vma_modify()` is only reachable through local address-space syscalls — `madvise(2)`, `mprotect(2)`, `mlock(2)`, `mseal(2)`, `mbind(2)` and userfaultfd register/unregister — all operating on the caller's own `mm_struct`. No remote peer or network-supplied data influences any field of the `vma_merge_struct`.\nAC:H - The corruption only occurs when the tiny `mas_preallocate(..., GFP_KERNEL)` in `commit_merge()` fails, and `maple_node_cache` is created without `SLAB_ACCOUNT`, so no memcg limit can force it and GFP_KERNEL simply retries reclaim indefinitely — the maintainer calls it \"practically impossible to hit in reality\" and syzbot required fault injection. That allocation failure is a condition the attacker cannot reliably induce.\nPR:L - Every entry point (`madvise_update_vma()`, `mprotect_fixup()`, `mlock_fixup()`, `mbind_range()`, `userfaultfd_register()`) is callable by any unprivileged process on its own mappings with no capability check and no user-namespace trick required.\nUI:N - The attacker's own process issues the syscall against its own VMA layout and drives the memory pressure; no other user or victim process needs to take any action.\nS:U - The mis-split VMAs, zero-length VMA and duplicated maple-tree entry all live in the calling process's `mm_struct` and are handled by the kernel under the same security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The bogus splits leave a zero-length VMA plus a second VMA duplicating an existing range in the maple tree, so subsequent `unmap_vmas()`/`free_pgtables()` walks operate on inconsistent ranges with wrong `prev`/`next` boundaries — page tables can be torn down while still mapped, yielding stale-mapping reads of kernel-freed memory.\nI:H - VMAs are split at addresses the caller never requested and flag changes are applied outside the requested range, and the resulting overlapping/zero-length VMA entries corrupt maple-tree and rmap invariants — mm metadata corruption of this class is leveragable into a write primitive rather than a bounded state change.\nA:H - The bug reproducibly fires `VM_WARN_ON_VMG(start >= end)` and the unconditional `WARN_ON(vma->vm_start >= addr)` in `__split_vma()` (a panic under `panic_on_warn`), and the resulting zero-length/overlapping VMAs cause oopses during later fault, `munmap` or `exit_mmap` processing." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/vma.c" ], "versions": [ { "version": "2f1c6611b0a89afcb8641471af5f223c9caa01e0", "lessThan": "79636d2981b066acd945117387a9533f56411f6f", "status": "affected", "versionType": "git" }, { "version": "2f1c6611b0a89afcb8641471af5f223c9caa01e0", "lessThan": "53fd215f7886a1e8dea5a9ca1391dbb697fff601", "status": "affected", "versionType": "git" }, { "version": "2f1c6611b0a89afcb8641471af5f223c9caa01e0", "lessThan": "47b16d0462a460000b8f05dfb1292377ac48f3ca", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/vma.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.19", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.7", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.13.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/79636d2981b066acd945117387a9533f56411f6f" }, { "url": "https://git.kernel.org/stable/c/53fd215f7886a1e8dea5a9ca1391dbb697fff601" }, { "url": "https://git.kernel.org/stable/c/47b16d0462a460000b8f05dfb1292377ac48f3ca" } ], "title": "mm: abort vma_modify() on merge out of memory failure", "x_generator": { "engine": "bippy-1.2.0" } } } }