The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - uprobes: Reject the shared zeropage in uprobe_write_opcode() We triggered the following crash in syzkaller     tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0     mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags:
    0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004     ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe     0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC     (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50     bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0     uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0
    __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280
    __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100     entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES     val:-1 The following syzkaller test case can be used to reproduce: r2 =     creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 =     openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0)     mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 =     userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 =     userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6,     0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5,     0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5,     &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB=1800000000120000000000000000000095],     &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff,     0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)     bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e,     @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The     cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage()     and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is     performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and     old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process     exit, the check_mm() report error Bad rss-count. 2. The reserved folio (zero folio) is freed when     folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error Bad page state. There     is more, the following warning could also theoretically be triggered: __replace_page() -> ... ->     folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on     the zero folio is a very rare case, just reject zero old folio immediately after     get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ] (CVE-2025-21881)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-21881

medium Nessus Plugin ID 244694

Version 1.9

Version 1.4

Version 1.3

Version 1.2

Version 1.9 Oct 14, 2025, 8:03 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202510140803
Version 1.4 Sep 6, 2025, 7:55 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509061955
Version 1.3 Sep 6, 2025, 2:03 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509060203
Version 1.2 Aug 27, 2025, 8:29 AM CVSS metrics ("CVSSv2 score" set to 4.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on CVE-2025-21881, severity increased from "Low" to "Medium") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508270829