Listen to this Post
How the CVE Works
This vulnerability is a complex race condition in the Linux kernel’s userfaultfd mechanism, specifically in the `userfaultfd_move` function. The flaw occurs during the handling of swap entries. When moving a page, the code performs a lockless lookup in the swap cache. It relies on checking the Page Table Entry (PTE) value to ensure the folio it found still corresponds to the original swap entry. This check is unreliable. An attacker can exploit tiny timing windows where a freed swap entry is reallocated to a different folio belonging to another process or VMA. Consequently, `userfaultfd_move` can incorrectly move the wrong folio, corrupting memory accounting (triggering “Bad rss-counter state” kernel bugs) and potentially leading to data corruption or privilege escalation by manipulating the memory contents of a separate process.
DailyCVE Form
Platform: Linux Kernel
Version: Up to resolution
Vulnerability: Race Condition
Severity: Critical
date: 07/09/2025
Prediction: Patch expected by late July 2025
What Undercode Say:
Analytics
git log --oneline --grep="userfaultfd_move" --grep="swap cache" cat /proc/vmstat | grep -i swap dmesg | grep "Bad rss-counter"
// Code snippet from the vulnerable function entry = pte_to_swp_entry(orig_src_pte); folio = filemap_get_folio(swap_address_space(entry), ...); // Race window exists here before folio_trylock
How Exploit:
Trigger race condition via userfaultfd, forcing target swap entry reuse to move incorrect folio, corrupting target process memory for privilege escalation.
Protection from this CVE
Apply kernel patch. Disable userfaultfd via sysctl vm.unprivileged_userfaultfd=0. Use kernels with the fix committing proper swap cache folio validation after locking.
Impact:
Kernel memory corruption, privilege escalation, system crashes, incorrect RSS accounting.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
