CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix hugepmdunshare() vs GUP-fast race
hugepmdunshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.
If this happens in the middle of a concurrent gupfast(), gupfast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.
Fix it with an explicit broadcast IPI through tlbremovetablesyncone(), just like we do in khugepaged when removing page tables for a THP collapse.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Fix the huge_pmd_unshare() versus GUP-fast race by issuing an explicit broadcast IPI through tlb_remove_table_sync_one(), as used in khugepaged when removing page tables for a THP collapse.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38085?
CVE-2025-38085 has not been assigned a severity rating, but it affects the Linux kernel's memory management functionality.
How do I fix CVE-2025-38085?
To fix CVE-2025-38085, update your Linux kernel to the latest version that contains the security patch.
What systems are affected by CVE-2025-38085?
CVE-2025-38085 affects the Linux kernel, particularly instances where hugetlbfs is used.
What are the potential impacts of CVE-2025-38085?
The vulnerability may lead to incorrect memory management, potentially allowing for privilege escalation or denial of service.
Has CVE-2025-38085 been publicly disclosed?
Yes, CVE-2025-38085 has been publicly documented and included in the Linux kernel change logs.