CVE-2025-22045

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix flushtlbrange() when used for zapping normal PMDs

On the following path, flushtlbrange() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table:

collapse_pte_mapped_thp
  pmdp_collapse_flush
    flush_tlb_range

The arm64 version of flushtlbrange() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way.

Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact:

• In nativeflushtlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks.
• In Hyper-V TLB paravirtualization, again for lazy TLB stuff.

The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/) would probably be making the impact of this a lot worse.