CVE-2025-21851

bpf: Fix softlockup in arena_map_free on 64k page kernel

State: Published
Severity: 7.8 High
Published: Mar 12, 2025
Updated: Aug 5, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix softlockup in arena_map_free on 64k page kernel

On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64.

It turns out arena_map_free() is calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start(). If this address is not page-aligned the code ends up calling apply_to_pte_range() with that unaligned address causing soft lockup.

Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	CISA-ADP

Weaknesses

CWE-667 Improper Locking

Affected Products

Product	Versions
LinuxLinux	317460317a02a1af512697e6e964298dedd8a163 to before c1f3f3892d4526f18aaeffdb6068ce861e793ee3Affected 317460317a02a1af512697e6e964298dedd8a163 to before 787d556a3de447e70964a4bdeba9196f62a62b1eAffected 317460317a02a1af512697e6e964298dedd8a163 to before 517e8a7835e8cfb398a0aeb0133de50e31cae32bAffected
LinuxLinux	6.9Affected before 6.9Not affected 6.12.17 through 6.12.Not affected 6.13.5 through 6.13.Not affected 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.