CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Fix flushtlbrange() when used for zapping normal PMDs
On the following path, flushtlbrange() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table:
collapseptemappedthp pmdpcollapseflush flushtlbrange
The arm64 version of flushtlbrange() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way.
Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact:
- In nativeflushtlbmulti() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.
The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) would probably be making the impact of this a lot worse.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.4.292 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.236 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.180 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.134 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.87 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.23 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.13.11 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.14.2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22045?
The severity of CVE-2025-22045 is classified as medium due to its potential impact on system stability.
How do I fix CVE-2025-22045?
To fix CVE-2025-22045, update the Linux kernel to a version that incorporates the patch provided in the security advisory.
What versions of the Linux kernel are affected by CVE-2025-22045?
CVE-2025-22045 affects multiple versions of the Linux kernel ranging from 4.20 to 6.14.2.
Can CVE-2025-22045 be exploited remotely?
CVE-2025-22045 is not considered to be remotely exploitable, as it primarily impacts local privilege escalation.
Is there a workaround for CVE-2025-22045?
There are no known workarounds for CVE-2025-22045, so applying the necessary updates is recommended.