CVE-2025-39899

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE<br /> <br /> With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using<br /> kmap_local_page(), which requires unmapping in Last-In-First-Out order.<br /> <br /> The current code maps dst_pte first, then src_pte, but unmaps them in the<br /> same order (dst_pte, src_pte), violating the LIFO requirement. This<br /> causes the warning in kunmap_local_indexed():<br /> <br /> WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c<br /> addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)<br /> <br /> Fix this by reversing the unmap order to respect LIFO ordering.<br /> <br /> This issue follows the same pattern as similar fixes:<br /> - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")<br /> - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")<br /> <br /> Both of which addressed the same fundamental requirement that kmap_local<br /> operations must follow LIFO ordering.