---
id: CVE-2025-21696
title: 'mm: clear uffd-wp PTE/PMD state on mremap()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm: clear uffd-wp PTE/PMD state on mremap()

  When mremap()ing a memory region previously registered with userfaultfd as
  write-protected but without UFFD_FEATURE_EVENT_R…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 <
    8e2f6ba256dd1e590addc48e6e9577bf39c482f2
  - >-
    Linux >= 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 <
    310ac886d68de661c3a334198d8604b722d7fdf8
  - >-
    Linux >= 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 <
    0cef0bb836e3cfe00f08f9606c72abd72fe78ca3
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T19:51:14.846865Z'
published: '2025-02-12'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:35:54.123Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21696'
references:
  - url: 'https://git.kernel.org/stable/c/8e2f6ba256dd1e590addc48e6e9577bf39c482f2'
  - url: 'https://git.kernel.org/stable/c/310ac886d68de661c3a334198d8604b722d7fdf8'
  - url: 'https://git.kernel.org/stable/c/0cef0bb836e3cfe00f08f9606c72abd72fe78ca3'
tags:
  - cve.org
epss: 0.00261
epssPercentile: 0.17841
ingestedAt: '2026-10-21T12:48:53.720Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm: clear uffd-wp PTE/PMD state on mremap()

When mremap()ing a memory region previously registered with userfaultfd as
write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency in
flag clearing leads to a mismatch between the vma flags (which have
uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp
cleared).  This mismatch causes a subsequent mprotect(PROT_WRITE) to
trigger a warning in page_table_check_pte_flags() due to setting the pte
to writable while uffd-wp is still set.

Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any
such mremap() so that the values are consistent with the existing clearing
of VM_UFFD_WP.  Be careful to clear the logical flag regardless of its
physical form; a PTE bit, a swap PTE bit, or a PTE marker.  Cover PTE,
huge PMD and hugetlb paths.

## Affected

- `Linux >= 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 < 8e2f6ba256dd1e590addc48e6e9577bf39c482f2`
- `Linux >= 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 < 310ac886d68de661c3a334198d8604b722d7fdf8`
- `Linux >= 63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 < 0cef0bb836e3cfe00f08f9606c72abd72fe78ca3`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.