Vulnerability in Linux
CVE-2025-21851
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64. It turns out arena_map_free() is calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start(). If this address is not page-aligned the code ends up calling apply_to_pte_range() with that unaligned address causing soft lockup. Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value.
EPSS: 0.002 (4.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions 317460317a02a1af512697e6e964298dedd8a163, 6.9, 0
- Linux Linux_kernel — versions 6.9, 6.14
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-21851?
- CVE-2025-21851 is a high-severity vulnerability in Linux, classified under Improper Locking. CVSS score: 7.8/10. Published 2025-03-12.
- How severe is CVE-2025-21851?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2025-21851 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.