In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix hugepmdunshare() vs GUP-fast race
hugepmdunshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.
If this happens in the middle of a concurrent gupfast(), gupfast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.
Fix it with an explicit broadcast IPI through tlbremovetablesyncone(), just like we do in khugepaged when removing page tables for a THP collapse.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"17632351818398378374125561967979747706",
"81429426131235052606312687586065660586",
"199945286857164580776008083860753290188",
"197354939091023365011923715038828527537"
]
},
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1013af4f585fccc4d3e5c5824d174de2257f7d6d",
"id": "CVE-2025-38085-13048491"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"17632351818398378374125561967979747706",
"81429426131235052606312687586065660586",
"199945286857164580776008083860753290188",
"197354939091023365011923715038828527537"
]
},
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@034a52b5ef57c9c8225d94e9067f3390bb33922f",
"id": "CVE-2025-38085-14b835eb"
},
{
"digest": {
"length": 508.0,
"function_hash": "259528212194024907113491528844366031531"
},
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@034a52b5ef57c9c8225d94e9067f3390bb33922f",
"id": "CVE-2025-38085-19b0d778"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"5323497783953752010074105867925984587",
"76998677434907518625859909722862711786",
"204321399708027414295945299252552790444",
"106066810262777068526121732175968607919"
]
},
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7754d3aa7bf9f62218d096c0c8f6c13698fac8b",
"id": "CVE-2025-38085-468a219a"
},
{
"digest": {
"length": 508.0,
"function_hash": "259528212194024907113491528844366031531"
},
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6bfeb97941a9187833b526bc6cc4ff5706d0ce9",
"id": "CVE-2025-38085-67569bdd"
},
{
"digest": {
"length": 508.0,
"function_hash": "259528212194024907113491528844366031531"
},
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1013af4f585fccc4d3e5c5824d174de2257f7d6d",
"id": "CVE-2025-38085-8688ef89"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"5323497783953752010074105867925984587",
"76998677434907518625859909722862711786",
"204321399708027414295945299252552790444",
"273092121291042429230678475907443781569"
]
},
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@952596b08c74e8fe9e2883d1dc8a8f54a37384ec",
"id": "CVE-2025-38085-a5657a14"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"17632351818398378374125561967979747706",
"81429426131235052606312687586065660586",
"199945286857164580776008083860753290188",
"197354939091023365011923715038828527537"
]
},
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6bfeb97941a9187833b526bc6cc4ff5706d0ce9",
"id": "CVE-2025-38085-aaadbe9b"
},
{
"digest": {
"length": 548.0,
"function_hash": "313951170181629474001191046093319196839"
},
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7754d3aa7bf9f62218d096c0c8f6c13698fac8b",
"id": "CVE-2025-38085-b32563d2"
},
{
"digest": {
"length": 568.0,
"function_hash": "229187709089829922077536117411197588241"
},
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3d864c901a300c295692d129159fc3001a56185",
"id": "CVE-2025-38085-bd905cb7"
},
{
"digest": {
"length": 508.0,
"function_hash": "259528212194024907113491528844366031531"
},
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe684290418ef9ef76630072086ee530b92f02b8",
"id": "CVE-2025-38085-d291f3e8"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"5323497783953752010074105867925984587",
"76998677434907518625859909722862711786",
"204321399708027414295945299252552790444",
"273092121291042429230678475907443781569"
]
},
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3d864c901a300c295692d129159fc3001a56185",
"id": "CVE-2025-38085-d6df5c6f"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"17632351818398378374125561967979747706",
"81429426131235052606312687586065660586",
"199945286857164580776008083860753290188",
"197354939091023365011923715038828527537"
]
},
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe684290418ef9ef76630072086ee530b92f02b8",
"id": "CVE-2025-38085-daff9dcd"
},
{
"digest": {
"length": 568.0,
"function_hash": "229187709089829922077536117411197588241"
},
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@952596b08c74e8fe9e2883d1dc8a8f54a37384ec",
"id": "CVE-2025-38085-fdf9b328"
}
]