CVE-2025-21851

bpf: Fix softlockup in arena_map_free on 64k page kernel

Low · published March 12, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix softlockup in arena_map_free on 64k page kernel

On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y,

arena_htab tests cause a segmentation fault and soft lockup.

The same failure is not observed with 4k pages on aarch64.

It turns out arena_map_free() is calling

apply_to_existing_page_range() with the address returned by

bpf_arena_get_kern_vm_start(). If this address is not page-aligned

the code ends up calling apply_to_pte_range() with that unaligned

address causing soft lockup.

Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the

division by 2 in bpf_arena_get_kern_vm_start() returns

a page-aligned value.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Published
2025-03-12T09:42Z
EPSS history
Timeline
  • 12 MAR 09:42Z
    bpf: Fix softlockup in arena_map_free on 64k page kernel
    cvelistv5