CVE-2025-21984

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: fix kernel BUG when userfaultfd_move encounters swapcache

userfaultfd_move() checks whether the PTE entry is present or a

swap entry.

- If the PTE entry is present, move_present_pte() handles folio

migration by setting:

src_folio->index = linear_page_index(dst_vma, dst_addr);

- If the PTE entry is a swap entry, move_swap_pte() simply copies

the PTE to the new dst_addr.

This approach is incorrect because, even if the PTE is a swap entry,

it can still reference a folio that remains in the swap cache.

This creates a race window between steps 2 and 4.

1. add_to_swap: The folio is added to the swapcache.

2. try_to_unmap: PTEs are converted to swap entries.

3. pageout: The folio is written back.

4. Swapcache is cleared.

If userfaultfd_move() occurs in the window between steps 2 and 4,

after the swap PTE has been moved to the destination, accessing the

destination triggers do_swap_page(), which may locate

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References