Answer in brief
CVE-2025-21696 records a Medium severity (CVSS 5.5) vulnerability in mm: clear uffd-wp PTE/PMD state on mremap(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 <8e2f6ba256dd1e590addc48e6e9577bf39c482f2 || >=63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 <310ac886d68de661c3a334198d8604b722d7fdf8 || >=63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 <0cef0bb836e3cfe00f08f9606c72abd72fe78ca3 | 8e2f6ba256dd1e590addc48e6e9577bf39c482f2, 310ac886d68de661c3a334198d8604b722d7fdf8, 0cef0bb836e3cfe00f08f9606c72abd72fe78ca3 |
| Linux/Linuxgeneric | 5.7 | Not reported |
Published upstream
Feb 12, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 21, 2026
In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap() When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency in flag clearing leads to a mismatch between the vma flags (which have uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp cleared). This mismatch causes a subsequent mprotect(PROT_WRITE) to trigger a warning in page_table_check_pte_flags() due to setting the pte to writable while uffd-wp is still set. Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any such mremap() so that the values are consistent with the existing clearing of VM_UFFD_WP. Be careful to clear the logical flag regardless of its physical form; a PTE bit, a swap PTE bit, or a PTE marker. Cover PTE, huge PMD and hugetlb paths.
Quoted source text, attributed separately from HOL analysis.