CVE-2025-38085 – Linux Kernel: Huge Page Table Unshare Race Condition Vulnerability

CVE ID : CVE-2025-38085

Published : June 28, 2025, 8:15 a.m. | 44 minutes ago

Description : In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

huge_pmd_unshare() drops a reference on a page table that may have
previously been shared across processes, potentially turning it into a
normal page table used in another process in which unrelated VMAs can
afterwards be installed.

If this happens in the middle of a concurrent gup_fast(), gup_fast() could
end up walking the page tables of another process. While I don’t see any
way in which that immediately leads to kernel memory corruption, it is
really weird and unexpected.

Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),
just like we do in khugepaged when removing page tables for a THP
collapse.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…