CVE-2025-21939

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid. So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno. However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory. Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that's a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region. This avoids marking pages that we don't own dirty and accessed, and it also avoid dereferencing struct pages that we don't own. v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld) v3: - Don't unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld) (cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)

• CWE-476

• https://git.kernel.org/stable/c/0a98219bcc961edd3388960576e4353e123b4a51Patch
• https://git.kernel.org/stable/c/2a24c98f0e4cc994334598d4f3a851972064809dPatch
• https://git.kernel.org/stable/c/f9326f529da7298a95643c3267f1c0fdb0db55ebPatch

Published

Apr 1, 2025

Last Modified

Jul 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-21933In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-21934In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-21935In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-21936In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-21937In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-21938In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2025-2194A vulnerability was found in MRCMS 3.1.2 and classified as p…6.1
• CVE-2025-21940In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-21941In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-21942In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-21943In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2025-21944In the Linux kernel, the following vulnerability has been re…5.5