CVE-2025-21851

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21851
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64. It turns out arena_map_free() is calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start(). If this address is not page-aligned the code ends up calling apply_to_pte_range() with that unaligned address causing soft lockup. Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/517e8a7835e8cfb398a0aeb0133de50e31cae32b Patch
https://git.kernel.org/stable/c/787d556a3de447e70964a4bdeba9196f62a62b1e Patch
https://git.kernel.org/stable/c/c1f3f3892d4526f18aaeffdb6068ce861e793ee3 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
History

13 Mar 2025, 16:29

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/517e8a7835e8cfb398a0aeb0133de50e31cae32b - () https://git.kernel.org/stable/c/517e8a7835e8cfb398a0aeb0133de50e31cae32b - Patch
References () https://git.kernel.org/stable/c/787d556a3de447e70964a4bdeba9196f62a62b1e - () https://git.kernel.org/stable/c/787d556a3de447e70964a4bdeba9196f62a62b1e - Patch
References () https://git.kernel.org/stable/c/c1f3f3892d4526f18aaeffdb6068ce861e793ee3 - () https://git.kernel.org/stable/c/c1f3f3892d4526f18aaeffdb6068ce861e793ee3 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Arregla el bloqueo suave en arena_map_free en un kernel de página de 64k En un kernel aarch64 con CONFIG_PAGE_SIZE_64KB=y, las pruebas arena_htab causan un fallo de segmentación y un bloqueo suave. No se observa el mismo fallo con páginas de 4k en aarch64. Resulta que arena_map_free() está llamando a apply_to_existing_page_range() con la dirección devuelta por bpf_arena_get_kern_vm_start(). Si esta dirección no está alineada con la página, el código termina llamando a apply_to_pte_range() con esa dirección no alineada, lo que causa un bloqueo suave. Arréglelo redondeando GUARD_SZ a PAGE_SIZE &lt;&lt; 1 para que la división por 2 en bpf_arena_get_kern_vm_start() devuelva un valor alineado con la página.
CWE CWE-667

12 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-12 10:15

Updated : 2025-03-13 16:29

NVD link : CVE-2025-21851

Mitre link : CVE-2025-21851

CVE.ORG link : CVE-2025-21851

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking