cbcvebase.
CVE-2025-38085
published 2025-06-28

CVE-2025-38085: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on…

medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.

Affected

34 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux
linuxlinux>= 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa < 952596b08c74e8fe9e2883d1dc8a8f54a37384ec952596b08c74e8fe9e2883d1dc8a8f54a37384ec
linuxlinux>= 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa < a3d864c901a300c295692d129159fc3001a56185a3d864c901a300c295692d129159fc3001a56185
linuxlinux>= 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa < b7754d3aa7bf9f62218d096c0c8f6c13698fac8bb7754d3aa7bf9f62218d096c0c8f6c13698fac8b
linuxlinux>= 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa < fe684290418ef9ef76630072086ee530b92f02b8fe684290418ef9ef76630072086ee530b92f02b8
linuxlinux>= 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa < 034a52b5ef57c9c8225d94e9067f3390bb33922f034a52b5ef57c9c8225d94e9067f3390bb33922f
linuxlinux>= 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa < a6bfeb97941a9187833b526bc6cc4ff5706d0ce9a6bfeb97941a9187833b526bc6cc4ff5706d0ce9
linuxlinux>= 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa < 1013af4f585fccc4d3e5c5824d174de2257f7d6d1013af4f585fccc4d3e5c5824d174de2257f7d6d
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 6.12.35-16.12.35-1
linuxlinux_kernel>= 0 < 5.15.0-156.1665.15.0-156.166
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 2.6.20 < 5.10.2395.10.239
linuxlinux_kernel>= 5.11 < 5.15.1865.15.186
linuxlinux_kernel>= 5.16 < 6.1.1426.1.142
linuxlinux_kernel>= 6.13 < 6.15.46.15.4
linuxlinux_kernel>= 6.2 < 6.6.956.6.95
linuxlinux_kernel>= 6.7 < 6.12.356.12.35
msrcazl3_kernel_6.6.92.2-2_on_azure_linux_3.0
msrcazl3_kernel_6.6.96.1-1_on_azure_linux_3.0

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.6MEDIUM