In the Linux kernel, the following vulnerability has been resolved:
arm: pgtable: fix NULL pointer dereference issue
When updatemmucacherange() is called by updatemmucache(), the vmf parameter is NULL, which will cause a NULL pointer dereference issue in adjustpte():
Unable to handle kernel NULL pointer dereference at virtual address 00000030 when read Hardware name: Atmel AT91SAM9 PC is at updatemmucacherange+0x1e0/0x278 LR is at pteoffsetmaprwnolock+0x18/0x2c Call trace: updatemmucacherange from removemigrationpte+0x29c/0x2ec removemigrationpte from rmapwalkfile+0xcc/0x130 rmapwalkfile from removemigrationptes+0x90/0xa4 removemigrationptes from migratepagesbatch+0x6d4/0x858 migratepagesbatch from migratepages+0x188/0x488 migratepages from compactzone+0x56c/0x954 compactzone from compactnode+0x90/0xf0 compactnode from kcompactd+0x1d4/0x204 kcompactd from kthread+0x120/0x12c kthread from retfromfork+0x14/0x38 Exception stack(0xc0d8bfb0 to 0xc0d8bff8)
To fix it, do not rely on whether 'ptl' is equal to decide whether to hold the pte lock, but decide it by whether CONFIGSPLITPTEPTLOCKS is enabled. In addition, if two vmas map to the same PTE page, there is no need to hold the pte lock again, otherwise a deadlock will occur. Just add the needlock parameter to let adjust_pte() know this information.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21933.json",
"cna_assigner": "Linux"
}