CVE-2025-38085

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38085
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38085.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38085
Downstream
Related
Published
2025-06-28T07:44:26.178Z
Modified
2026-03-20T12:42:40.070929Z
Summary
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
Details

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugepmdunshare() vs GUP-fast race

hugepmdunshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.

If this happens in the middle of a concurrent gupfast(), gupfast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.

Fix it with an explicit broadcast IPI through tlbremovetablesyncone(), just like we do in khugepaged when removing page tables for a THP collapse.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38085.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
Fixed
952596b08c74e8fe9e2883d1dc8a8f54a37384ec
Fixed
a3d864c901a300c295692d129159fc3001a56185
Fixed
b7754d3aa7bf9f62218d096c0c8f6c13698fac8b
Fixed
fe684290418ef9ef76630072086ee530b92f02b8
Fixed
034a52b5ef57c9c8225d94e9067f3390bb33922f
Fixed
a6bfeb97941a9187833b526bc6cc4ff5706d0ce9
Fixed
1013af4f585fccc4d3e5c5824d174de2257f7d6d

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38085.json"