CVE-2025-38085

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38085
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f Patch
https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d Patch
https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec Patch
https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185 Patch
https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9 Patch
https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b Patch
https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8 Patch
https://project-zero.issues.chromium.org/issues/420715744 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

18 Dec 2025, 21:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f - () https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f - Patch
References () https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d - () https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d - Patch
References () https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec - () https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec - Patch
References () https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185 - () https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185 - Patch
References () https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9 - () https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9 - Patch
References () https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b - () https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b - Patch
References () https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8 - () https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8 - Patch
References () https://project-zero.issues.chromium.org/issues/420715744 - () https://project-zero.issues.chromium.org/issues/420715744 - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CWE CWE-362

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

30 Jul 2025, 06:15

Type Values Removed Values Added
References
  • () https://project-zero.issues.chromium.org/issues/420715744 -

30 Jun 2025, 18:38

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/hugetlb: corrección de huge_pmd_unshare() frente a la competencia GUP-fast. huge_pmd_unshare() elimina una referencia en una tabla de páginas que podría haber sido compartida previamente entre procesos, lo que podría convertirla en una tabla de páginas normal utilizada por otro proceso en la que posteriormente se podrían instalar VMAs no relacionadas. Si esto ocurre durante una ejecución simultánea de gup_fast(), gup_fast() podría terminar recorriendo las tablas de páginas de otro proceso. Si bien no veo ninguna forma en que esto provoque inmediatamente una corrupción de memoria en el kernel, es realmente extraño e inesperado. Corríjalo con una IPI de difusión explícita a través de tlb_remove_table_sync_one(), tal como hacemos en khugepaged al eliminar tablas de páginas durante un colapso de THP.

28 Jun 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-28 08:15

Updated : 2025-12-18 21:21

NVD link : CVE-2025-38085

Mitre link : CVE-2025-38085

CVE.ORG link : CVE-2025-38085

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')