CVE-2025-38085

mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

State: Published
Severity: 7.8 High
Published: Jun 28, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.

If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.

Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before 952596b08c74e8fe9e2883d1dc8a8f54a37384ecAffected 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before a3d864c901a300c295692d129159fc3001a56185Affected 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before b7754d3aa7bf9f62218d096c0c8f6c13698fac8bAffected 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before fe684290418ef9ef76630072086ee530b92f02b8Affected 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before 034a52b5ef57c9c8225d94e9067f3390bb33922fAffected 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before a6bfeb97941a9187833b526bc6cc4ff5706d0ce9Affected 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before 1013af4f585fccc4d3e5c5824d174de2257f7d6dAffected
LinuxLinux	2.6.20Affected before 2.6.20Not affected 5.10.239 through 5.10.Not affected 5.15.186 through 5.15.Not affected 6.1.142 through 6.1.Not affected 6.6.95 through 6.6.Not affected 6.12.35 through 6.12.Not affected 6.15.4 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before 952596b08c74e8fe9e2883d1dc8a8f54a37384ecAffected
39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before a3d864c901a300c295692d129159fc3001a56185Affected
39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before b7754d3aa7bf9f62218d096c0c8f6c13698fac8bAffected
39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before fe684290418ef9ef76630072086ee530b92f02b8Affected
39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before 034a52b5ef57c9c8225d94e9067f3390bb33922fAffected
39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before a6bfeb97941a9187833b526bc6cc4ff5706d0ce9Affected
39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa to before 1013af4f585fccc4d3e5c5824d174de2257f7d6dAffected

LinuxLinux

2.6.20Affected
before 2.6.20Not affected
5.10.239 through 5.10.*Not affected
5.15.186 through 5.15.*Not affected
6.1.142 through 6.1.*Not affected
6.6.95 through 6.6.*Not affected
6.12.35 through 6.12.*Not affected
6.15.4 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.