Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order. The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed(): WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx) Fix this by reversing the unmap order to respect LIFO ordering. This issue follows the same pattern as similar fixes: - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order") - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename") Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected adef440691bab824e39c1b17382322d195e1fab0 before b051f707018967ea8f697d790a1ed8c443f63812; affected adef440691bab824e39c1b17382322d195e1fab0 before bd1ee62759d0bd4d6b909731c076c230ac89d61e; affected adef440691bab824e39c1b17382322d195e1fab0 before 9614d8bee66387501f48718fa306e17f2aa3f2f3 |
| Linux / Linux | affected 6.8; unaffected 0 before 6.8; unaffected 6.12.46 through 6.12.*; unaffected 6.16.6 through 6.16.*; unaffected 6.17 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/b051f707018967ea8f697d790a1ed8c443f63812
- https://git.kernel.org/stable/c/bd1ee62759d0bd4d6b909731c076c230ac89d61e
- https://git.kernel.org/stable/c/9614d8bee66387501f48718fa306e17f2aa3f2f3
ADP enrichment
No English description supplied.
No references supplied.