Security tracker / CVE-2025-21881

CVE-2025-21881

uprobes: Reject the shared zeropage in uprobe_write_opcode()

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 7396fa818d62 ("uprobes/core: Make background page replacement
 carnil> logic account for rss_stat counters")
 carnil> 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes
 carnil> breakpoints"). Vulnerable versions: 3.5.

Bugs

Status

Branch	Status
upstream	released (6.14-rc5) [bddf10d26e6e5114e7415a0e442ec6f51a559468]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.13-upstream-stable	released (6.13.6) [54011fc94422f094eaf47555284de70a4bc32bb9]
6.12-upstream-stable	released (6.12.18) [13cca2b73e2b0ec3ea6d6615d615395621d22752]
6.6-upstream-stable	released (6.6.81) [0b6f19714588cf2366b0364234f97ba963688f63]
6.1-upstream-stable	released (6.1.130) [c4cb2bfa99513311886c1eb5c1c2ac26f3338a6e]
5.10-upstream-stable	needed
sid	released (6.12.19-1)
6.12-trixie-security	N/A "Fixed before branching point"
6.1-bookworm-security	released (6.1.133-1)
5.10-bullseye-security	needed