CVE-2025-21933

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21933
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21933.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21933
Downstream
Published
2025-04-01T15:41:02.300Z
Modified
2025-12-02T06:18:52.824894Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
arm: pgtable: fix NULL pointer dereference issue
Details

In the Linux kernel, the following vulnerability has been resolved:

arm: pgtable: fix NULL pointer dereference issue

When updatemmucacherange() is called by updatemmucache(), the vmf parameter is NULL, which will cause a NULL pointer dereference issue in adjustpte():

Unable to handle kernel NULL pointer dereference at virtual address 00000030 when read Hardware name: Atmel AT91SAM9 PC is at updatemmucacherange+0x1e0/0x278 LR is at pteoffsetmaprwnolock+0x18/0x2c Call trace: updatemmucacherange from removemigrationpte+0x29c/0x2ec removemigrationpte from rmapwalkfile+0xcc/0x130 rmapwalkfile from removemigrationptes+0x90/0xa4 removemigrationptes from migratepagesbatch+0x6d4/0x858 migratepagesbatch from migratepages+0x188/0x488 migratepages from compactzone+0x56c/0x954 compactzone from compactnode+0x90/0xf0 compactnode from kcompactd+0x1d4/0x204 kcompactd from kthread+0x120/0x12c kthread from retfromfork+0x14/0x38 Exception stack(0xc0d8bfb0 to 0xc0d8bff8)

To fix it, do not rely on whether 'ptl' is equal to decide whether to hold the pte lock, but decide it by whether CONFIGSPLITPTEPTLOCKS is enabled. In addition, if two vmas map to the same PTE page, there is no need to hold the pte lock again, otherwise a deadlock will occur. Just add the needlock parameter to let adjust_pte() know this information.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21933.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fc9c45b71f43cafcc0435dd4c7a2d3b99955a0fa
Fixed
91d011efe30aedde067ce6d218d521cf99b162e5
Fixed
a564ccfe300fa6a065beda06ab7f3c140d6b4d63

Affected versions

v6.*

v6.12
v6.12-rc7
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.2
v6.13.3
v6.13.4
v6.13.5
v6.13.6
v6.14-rc1
v6.14-rc2
v6.14-rc3

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.7