{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38242", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.996Z", "datePublished": "2025-07-09T10:42:25.396Z", "dateUpdated": "2026-08-05T12:00:38.652Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:38.652Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: userfaultfd: fix race of userfaultfd_move and swap cache\n\nThis commit fixes two kinds of races, they may have different results:\n\nBarry reported a BUG_ON in commit c50f8e6053b0, we may see the same\nBUG_ON if the filemap lookup returned NULL and folio is added to swap\ncache after that.\n\nIf another kind of race is triggered (folio changed after lookup) we\nmay see RSS counter is corrupted:\n\n[ 406.893936] BUG: Bad rss-counter state mm:ffff0000c5a9ddc0\ntype:MM_ANONPAGES val:-1\n[ 406.894071] BUG: Bad rss-counter state mm:ffff0000c5a9ddc0\ntype:MM_SHMEMPAGES val:1\n\nBecause the folio is being accounted to the wrong VMA.\n\nI'm not sure if there will be any data corruption though, seems no. \nThe issues above are critical already.\n\n\nOn seeing a swap entry PTE, userfaultfd_move does a lockless swap cache\nlookup, and tries to move the found folio to the faulting vma. Currently,\nit relies on checking the PTE value to ensure that the moved folio still\nbelongs to the src swap entry and that no new folio has been added to the\nswap cache, which turns out to be unreliable.\n\nWhile working and reviewing the swap table series with Barry, following\nexisting races are observed and reproduced [1]:\n\nIn the example below, move_pages_pte is moving src_pte to dst_pte, where\nsrc_pte is a swap entry PTE holding swap entry S1, and S1 is not in the\nswap cache:\n\nCPU1 CPU2\nuserfaultfd_move\n move_pages_pte()\n entry = pte_to_swp_entry(orig_src_pte);\n // Here it got entry = S1\n ... < interrupted> ...\n \n // folio A is a new allocated folio\n // and get installed into src_pte\n \n // src_pte now points to folio A, S1\n // has swap count == 0, it can be freed\n // by folio_swap_swap or swap\n // allocator's reclaim.\n \n // folio B is a folio in another VMA.\n \n // S1 is freed, folio B can use it\n // for swap out with no problem.\n ...\n folio = filemap_get_folio(S1)\n // Got folio B here !!!\n ... < interrupted again> ...\n \n // Now S1 is free to be used again.\n \n // Now src_pte is a swap entry PTE\n // holding S1 again.\n folio_trylock(folio)\n move_swap_pte\n double_pt_lock\n is_pte_pages_stable\n // Check passed because src_pte == S1\n folio_move_anon_rmap(...)\n // Moved invalid folio B here !!!\n\nThe race window is very short and requires multiple collisions of multiple\nrare events, so it's very unlikely to happen, but with a deliberately\nconstructed reproducer and increased time window, it can be reproduced\neasily.\n\nThis can be fixed by checking if the folio returned by filemap is the\nvalid swap cache folio after acquiring the folio lock.\n\nAnother similar race is possible: filemap_get_folio may return NULL, but\nfolio (A) could be swapped in and then swapped out again using the same\nswap entry after the lookup. In such a case, folio (A) may remain in the\nswap cache, so it must be moved too:\n\nCPU1 CPU2\nuserfaultfd_move\n move_pages_pte()\n entry = pte_to_swp_entry(orig_src_pte);\n // Here it got entry = S1, and S1 is not in swap cache\n folio = filemap_get\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only through local syscalls — `userfaultfd(2)`/`/dev/userfaultfd` followed by `ioctl(UFFDIO_MOVE)` on the caller's own mm, combined with `madvise(MADV_PAGEOUT)` to drive swap. There is no remote or adjacent-network path into mm/userfaultfd.c.\nAC:L - The attacker controls every side of the race — the `UFFDIO_MOVE` thread, the faulting thread that swaps the entry back in, and `MADV_PAGEOUT` which forces the swap-out that recycles the entry — and can retry indefinitely at no cost, which the authors confirm by reproducing it with a constructed reproducer. Swap (including zram/zswap on Android and embedded targets) is the common default configuration, so no rare kernel option is required.\nPR:L - Any unprivileged local user can create a userfaultfd with `UFFD_USER_MODE_ONLY`, which `userfaultfd_syscall_allowed()` permits unconditionally regardless of `vm.unprivileged_userfaultfd` or `CAP_SYS_PTRACE`, and that flag does not restrict `UFFDIO_MOVE` at all. Registering two private anonymous VMAs and issuing the ioctl requires no capability whatsoever.\nUI:N - The attacker performs all operations within its own process and address space; no action by any other user or victim process is needed.\nS:U - The corruption occurs in kernel mm structures and is exploited to gain kernel-level control within the same security authority, following the standard kernel privilege-escalation convention. No hypervisor, IOMMU, or DMA boundary is crossed.\nC:H - `folio_move_anon_rmap()` re-parents a folio belonging to a *different* VMA — potentially another process's anon page or a shmem/tmpfs page-cache folio — into the attacker's `anon_vma` at an attacker-chosen index, so foreign page contents can become reachable from the attacker's address space. The resulting `address_space`/`anon_vma` type confusion and broken rmap state provide a general kernel-memory read primitive.\nI:H - The bug lets an unprivileged process overwrite `folio->mapping` and `folio->index` on a folio it does not own, producing a hard type confusion between `struct anon_vma` and `struct address_space` (including reachable `a_ops` function pointers) plus corrupted RSS accounting and rmap invariants. This is classic heap-groom-able memory corruption exploitable for arbitrary write and control-flow hijack.\nA:H - The commit documents a reproducible `kernel BUG at mm/rmap.c:1380` in `__page_check_anon_rmap()` reached from `do_swap_page()`, an unrecoverable oops, plus `BUG: Bad rss-counter state` on teardown. Any unprivileged user can trigger a full kernel panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/userfaultfd.c" ], "versions": [ { "version": "adef440691bab824e39c1b17382322d195e1fab0", "lessThan": "4c443046d8c9ed8724a4f4c3c2457d3ac8814b2f", "status": "affected", "versionType": "git" }, { "version": "adef440691bab824e39c1b17382322d195e1fab0", "lessThan": "db2ca8074955ca64187a4fb596dd290b9c446cd3", "status": "affected", "versionType": "git" }, { "version": "adef440691bab824e39c1b17382322d195e1fab0", "lessThan": "0ea148a799198518d8ebab63ddd0bb6114a103bc", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/userfaultfd.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.37", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.5", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.37" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.15.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4c443046d8c9ed8724a4f4c3c2457d3ac8814b2f" }, { "url": "https://git.kernel.org/stable/c/db2ca8074955ca64187a4fb596dd290b9c446cd3" }, { "url": "https://git.kernel.org/stable/c/0ea148a799198518d8ebab63ddd0bb6114a103bc" } ], "title": "mm: userfaultfd: fix race of userfaultfd_move and swap cache", "x_generator": { "engine": "bippy-1.2.0" } } } }