Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-22045

x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.292, 5.10.236, 5.15.180, 6.1.134, 6.6.87, and 3 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way. Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact: • In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. • In Hyper-V TLB paravirtualization, again for lazy TLB stuff. The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) would probably be making the impact of this a lot worse.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 618d5612ecb7bfc1c85342daafeb2b47e29e77a3; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 556d446068f90981e5d71ca686bdaccdd545d491; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 0708fd6bd8161871bfbadced2ca4319b84ab44fe; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 7085895c59e4057ffae17f58990ccb630087d0d2; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 93224deb50a8d20df3884f3672ce9f982129aa50; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 320ac1af4c0bdb92c864dc9250d1329234820edf; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be; From 016c4d92cd16f569c6485ae62b076c1a4b779536 · fixed in 3ef938c3503563bfc2ac15083557f880d29c2e64

  • Linux Linux

    4.20

  • KernelLinux

    From 4.20.0 · fixed in 5.4.292; From 5.5.0 · fixed in 5.10.236; From 5.11.0 · fixed in 5.15.180; From 5.16.0 · fixed in 6.1.134; From 6.2.0 · fixed in 6.6.87; From 6.7.0 · fixed in 6.12.23; From 6.13.0 · fixed in 6.13.11; From 6.14.0 · fixed in 6.14.2

References 9

git.kernel.org