{"id":"CVE-2025-21709","revision":"b901fbf5455142fd93d7b64b20c86f21","records":[{"revision":"b901fbf5455142fd93d7b64b20c86f21","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21709","aliases":[],"title":"kernel: be more careful about dup_mmap() failures and uprobe registering","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkernel: be more careful about dup_mmap() failures and uprobe registering\n\nIf a memory allocation fails during dup_mmap(), the maple tree can be left\nin an unsafe state for other iterators besides the exit path.  All the\nlocks are dropped before the exit_mmap() call (in mm/mmap.c), but the\nincomplete mm_struct can be reached through (at least) the rmap finding\nthe vmas which have a pointer back to the mm_struct.\n\nUp to this point, there have been no issues with being able to find an\nmm_struct that was only partially initialised.  Syzbot was able to make\nthe incomplete mm_struct fail with recent forking changes, so it has been\nproven unsafe to use the mm_struct that hasn't been initialised, as\nreferenced in the link below.\n\nAlthough 8ac662f5da19f (\"fork: avoid inappropriate uprobe access to\ninvalid mm\") fixed the uprobe access, it does not completely remove the\nrace.\n\nThis patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the\noom side (even though this is extremely unlikely to be selected as an oom\nvictim in the race window), and sets MMF_UNSTABLE to avoid other potential\nusers from using a partially initialised mm_struct.\n\nWhen registering vmas for uprobe, skip the vmas in an mm that is marked\nunstable.  Modifying a vma in an unstable mm may cause issues if the mm\nisn't fully initialised.","state":0,"publishedAt":"2025-02-27T02:07:22.452+00:00","modifiedAt":"2026-10-15T21:51:52.263+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/events/uprobes.c\",\n                        \"kernel/fork.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d2406291483775ecddaee929231a39c70c08fda2\",\n                            \"lessThan\": \"74c2471eb891a7dcb3874b21c106cda75f52be30\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d2406291483775ecddaee929231a39c70c08fda2\",\n                            \"lessThan\": \"da139948aeda677ac09cc0e7d837f8a314de7d55\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d2406291483775ecddaee929231a39c70c08fda2\",\n                            \"lessThan\": \"64c37e134b120fb462fb4a80694bfb8e7be77b14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/events/uprobes.c\",\n                        \"kernel/fork.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.83\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.2\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/74c2471eb891a7dcb3874b21c106cda75f52be30","https://git.kernel.org/stable/c/da139948aeda677ac09cc0e7d837f8a314de7d55","https://git.kernel.org/stable/c/64c37e134b120fb462fb4a80694bfb8e7be77b14"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21709","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21709","identifiers":["CVE-2025-21709"]},"retained":false,"historicalAffected":[]}],"coverage":[]}