CVE-2025-21693

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: zswap: properly synchronize freeing resources during CPU hotunplug

In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the

current CPU at the beginning of the operation is retrieved and used

throughout. However, since neither preemption nor migration are disabled,

it is possible that the operation continues on a different CPU.

If the original CPU is hotunplugged while the acomp_ctx is still in use,

we run into a UAF bug as some of the resources attached to the acomp_ctx

are freed during hotunplug in zswap_cpu_comp_dead() (i.e.

acomp_ctx.buffer, acomp_ctx.req, or acomp_ctx.acomp).

The problem was introduced in commit 1ec3b5fe6eec ("mm/zswap: move to use

crypto_acomp API for hardware acceleration") when the switch to the

crypto_acomp API was made. Prior to that, the per-CPU crypto_comp was

retrieved using get_cpu_ptr() which disables preemption and makes sure the

CPU cannot go away from under

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References