CVE-2025-21939 (GCVE-0-2025-21939)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:41 – Updated: 2026-08-05 11:55
VLAI
Title
drm/xe/hmm: Don't dereference struct page pointers without notifier lock
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid. So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno. However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory. Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that's a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region. This avoids marking pages that we don't own dirty and accessed, and it also avoid dereferencing struct pages that we don't own. v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld) v3: - Don't unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld) (cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3 , < 2a24c98f0e4cc994334598d4f3a851972064809d (git)
Affected: 81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3 , < f9326f529da7298a95643c3267f1c0fdb0db55eb (git)
Affected: 81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3 , < 0a98219bcc961edd3388960576e4353e123b4a51 (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.19 , ≤ 6.12.* (semver)
Unaffected: 6.13.7 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2a24c98f0e4cc994334598d4f3a851972064809d",
              "status": "affected",
              "version": "81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3",
              "versionType": "git"
            },
            {
              "lessThan": "f9326f529da7298a95643c3267f1c0fdb0db55eb",
              "status": "affected",
              "version": "81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3",
              "versionType": "git"
            },
            {
              "lessThan": "0a98219bcc961edd3388960576e4353e123b4a51",
              "status": "affected",
              "version": "81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.19",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock\n\nThe pnfs that we obtain from hmm_range_fault() point to pages that\nwe don\u0027t have a reference on, and the guarantee that they are still\nin the cpu page-tables is that the notifier lock must be held and the\nnotifier seqno is still valid.\n\nSo while building the sg table and marking the pages accesses / dirty\nwe need to hold this lock with a validated seqno.\n\nHowever, the lock is reclaim tainted which makes\nsg_alloc_table_from_pages_segment() unusable, since it internally\nallocates memory.\n\nInstead build the sg-table manually. For the non-iommu case\nthis might lead to fewer coalesces, but if that\u0027s a problem it can\nbe fixed up later in the resource cursor code. For the iommu case,\nthe whole sg-table may still be coalesced to a single contigous\ndevice va region.\n\nThis avoids marking pages that we don\u0027t own dirty and accessed, and\nit also avoid dereferencing struct pages that we don\u0027t own.\n\nv2:\n- Use assert to check whether hmm pfns are valid (Matthew Auld)\n- Take into account that large pages may cross range boundaries\n  (Matthew Auld)\n\nv3:\n- Don\u0027t unnecessarily check for a non-freed sg-table. (Matthew Auld)\n- Add a missing up_read() in an error path. (Matthew Auld)\n\n(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through Intel Xe DRM ioctls (`DRM_IOCTL_XE_VM_BIND`, `DRM_IOCTL_XE_EXEC`) or GPU page faults raised by the attacker\u0027s own submitted workload, all requiring an open handle on the local `/dev/dri/renderD*` node. There is no remote or adjacent-network reachability.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues the userptr bind/exec while another munmaps, MADV_DONTNEEDs, or migrates the same user range \u2014 and can widen the window arbitrarily by sizing the userptr range so the intervening `kvmalloc_array()` and `sg_alloc_table_from_pages_segment()` GFP_KERNEL allocations enter direct reclaim. No condition outside the attacker\u0027s influence is required.\nPR:L - An unprivileged local account with render-node access is sufficient; these are all DRM_RENDER_ALLOW ioctls, and render nodes are granted to ordinary logged-in desktop users, Android apps, and GPU-passthrough containers by default. No CAP_SYS_ADMIN or root is needed.\nUI:N - The attacker triggers the entire sequence from its own threads via ioctls and memory-management syscalls on its own address space. No action by any other user is required.\nS:U - The corruption occurs in kernel page/folio metadata and kernel-managed DMA mappings, within the same security authority as the vulnerable driver. Standard kernel memory corruption leading to local privilege escalation does not cross a scope boundary.\nC:H - This is a use-after-free on unreferenced pages: freed pages can be reallocated to other processes or the kernel and are still DMA-mapped DMA_BIDIRECTIONAL for the GPU and read via struct page dereferences, giving an attacker who grooms the reallocation a path to read memory belonging to other security contexts.\nI:H - `set_page_dirty_lock()` on a reallocated folio calls `mapping-\u003ea_ops-\u003edirty_folio()` through a function pointer read from memory the driver no longer owns \u2014 a control-flow hijack primitive \u2014 and also wrongly dirties foreign page-cache folios (causing writeback of unintended data) while `mark_page_accessed()` corrupts LRU lists. Per kernel UAF guidance this yields arbitrary-write/code-execution potential.\nA:H - Even without full exploitation, LRU list manipulation on a freed folio, breaking another owner\u0027s page lock via `folio_unlock()`, and refcount assertions on zero-refcount pages produce list-debug BUGs, oopses, and kernel panics. Any local user with render-node access can trigger this repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:29.323Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2a24c98f0e4cc994334598d4f3a851972064809d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9326f529da7298a95643c3267f1c0fdb0db55eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a98219bcc961edd3388960576e4353e123b4a51"
        }
      ],
      "title": "drm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21939",
    "datePublished": "2025-04-01T15:41:05.393Z",
    "dateReserved": "2024-12-29T08:45:45.789Z",
    "dateUpdated": "2026-08-05T11:55:29.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21939",
      "date": "2026-08-09",
      "epss": "0.00201",
      "percentile": "0.10196"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21939\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:24.773\",\"lastModified\":\"2026-07-30T06:21:58.380\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock\\n\\nThe pnfs that we obtain from hmm_range_fault() point to pages that\\nwe don\u0027t have a reference on, and the guarantee that they are still\\nin the cpu page-tables is that the notifier lock must be held and the\\nnotifier seqno is still valid.\\n\\nSo while building the sg table and marking the pages accesses / dirty\\nwe need to hold this lock with a validated seqno.\\n\\nHowever, the lock is reclaim tainted which makes\\nsg_alloc_table_from_pages_segment() unusable, since it internally\\nallocates memory.\\n\\nInstead build the sg-table manually. For the non-iommu case\\nthis might lead to fewer coalesces, but if that\u0027s a problem it can\\nbe fixed up later in the resource cursor code. For the iommu case,\\nthe whole sg-table may still be coalesced to a single contigous\\ndevice va region.\\n\\nThis avoids marking pages that we don\u0027t own dirty and accessed, and\\nit also avoid dereferencing struct pages that we don\u0027t own.\\n\\nv2:\\n- Use assert to check whether hmm pfns are valid (Matthew Auld)\\n- Take into account that large pages may cross range boundaries\\n  (Matthew Auld)\\n\\nv3:\\n- Don\u0027t unnecessarily check for a non-freed sg-table. (Matthew Auld)\\n- Add a missing up_read() in an error path. (Matthew Auld)\\n\\n(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe/hmm: No desreferenciar punteros de p\u00e1gina de estructura sin bloqueo de notificador Los pnfs que obtenemos de hmm_range_fault() apuntan a p\u00e1ginas en las que no tenemos una referencia, y la garant\u00eda de que a\u00fan est\u00e1n en las tablas de p\u00e1ginas de la CPU es que el bloqueo del notificador debe mantenerse y el seqno del notificador a\u00fan es v\u00e1lido. Entonces, mientras construimos la tabla sg y marcamos las p\u00e1ginas como accedidas/sucias, necesitamos mantener este bloqueo con un seqno validado. Sin embargo, el bloqueo est\u00e1 contaminado por recuperaci\u00f3n, lo que hace que sg_alloc_table_from_pages_segment() sea inutilizable, ya que asigna memoria internamente. En su lugar, construya la tabla sg manualmente. Para el caso que no es iommu, esto podr\u00eda llevar a menos coalescencias, pero si eso es un problema, se puede arreglar m\u00e1s adelante en el c\u00f3digo del cursor de recursos. En el caso de iommu, toda la tabla sg puede fusionarse en una \u00fanica regi\u00f3n va de dispositivo contiguo. Esto evita marcar p\u00e1ginas que no son de nuestra propiedad como sucias y accedidas, y tambi\u00e9n evita desreferenciar p\u00e1ginas de estructura que no son de nuestra propiedad. v2: - Usar assert para comprobar si las funciones de funci\u00f3n de enlace de hmm son v\u00e1lidas (Matthew Auld). - Tener en cuenta que las p\u00e1ginas grandes pueden cruzar los l\u00edmites de rango (Matthew Auld). v3: - No comprobar innecesariamente si hay una tabla sg no liberada (Matthew Auld). - A\u00f1adir una funci\u00f3n up_read() faltante en una ruta de error (Matthew Auld). (Seleccionado de el commit ea3e66d280ce2576664a862693d1da8fd324c317).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_hmm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3\",\"lessThan\":\"2a24c98f0e4cc994334598d4f3a851972064809d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3\",\"lessThan\":\"f9326f529da7298a95643c3267f1c0fdb0db55eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81e058a3e7fd8593d076b4f26f7b8bb49f1d61e3\",\"lessThan\":\"0a98219bcc961edd3388960576e4353e123b4a51\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_hmm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.19\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.7\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.12.19\",\"matchCriteriaId\":\"D5EF0086-F7C3-45D5-9961-FB5D0F4B7678\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.7\",\"matchCriteriaId\":\"842F5A44-3E71-4546-B4FD-43B0ACE3F32B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a98219bcc961edd3388960576e4353e123b4a51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a24c98f0e4cc994334598d4f3a851972064809d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9326f529da7298a95643c3267f1c0fdb0db55eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:38:11+00:00",
      "cve": "CVE-2025-21939",
      "id": "CVE-2025-21939",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21939.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:19:03Z",
      "cve": "CVE-2025-21939",
      "id": "CVE-2025-21939",
      "initial_release_date": "2025-04-04T02:58:58Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "344",
      "product_status:recommended": "164",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21939",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21939.json",
      "version": "21"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.