{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-22045", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.810Z", "datePublished": "2025-04-16T14:12:05.849Z", "dateUpdated": "2026-08-05T11:56:18.577Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:18.577Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Fix flush_tlb_range() when used for zapping normal PMDs\n\nOn the following path, flush_tlb_range() can be used for zapping normal\nPMD entries (PMD entries that point to page tables) together with the PTE\nentries in the pointed-to page table:\n\n collapse_pte_mapped_thp\n pmdp_collapse_flush\n flush_tlb_range\n\nThe arm64 version of flush_tlb_range() has a comment describing that it can\nbe used for page table removal, and does not use any last-level\ninvalidation optimizations. Fix the X86 version by making it behave the\nsame way.\n\nCurrently, X86 only uses this information for the following two purposes,\nwhich I think means the issue doesn't have much impact:\n\n - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be\n IPI'd to avoid issues with speculative page table walks.\n - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.\n\nThe patch \"x86/mm: only invalidate final translations with INVLPGB\" which\nis currently under review (see\n)\nwould probably be making the impact of this a lot worse." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached from the `madvise(MADV_COLLAPSE)` syscall (or khugepaged) on the calling process's own address space, requiring local access to the system. There is no remote or adjacent-network entry point into `pmdp_collapse_flush()`.\nAC:L - The attacker controls every element needed: triggering the PMD zap via `MADV_COLLAPSE` on demand, pinning threads so remote CPUs enter lazy TLB mode with the mm still in CR3, generating kernel work so those lazy CPUs are actively executing, and spraying the page-table page after `pte_free_defer()` releases it. Both sides of the window are attacker-created and the sequence can be repeated indefinitely.\nPR:L - `MADV_COLLAPSE` on the caller's own mm has no capability check in `mm/madvise.c` (the `CAP_SYS_ADMIN` test at line 1362 covers `MADV_HWPOISON`, and `CAP_SYS_NICE` at line 1803 only applies to remote mms). Any unprivileged local user, including one inside a container or user namespace, can drive the path.\nUI:N - The attacker triggers the collapse entirely from its own process via a syscall; no action by any other user or administrator is needed. khugepaged also reaches the same path autonomously.\nS:U - The stale paging-structure state and any resulting corruption stay within the kernel's own security authority on the affected host or guest. No IOMMU, hypervisor, or VM boundary is crossed.\nC:H - A lazy-TLB CPU speculatively walking the freed-and-reused page-table page interprets attacker-sprayable memory as PTEs, which can map user virtual addresses to arbitrary physical frames and expose their contents through transient execution. That amounts to an arbitrary physical-memory read primitive rather than a bounded leak.\nI:H - The same bogus paging-structure entries constructed from attacker-controlled data can point a user virtual address at arbitrary physical memory, giving a write primitive over kernel or other-process pages. Corruption of page-table translations is directly leverageable for control-flow hijacking and privilege escalation.\nA:H - Speculative page-table walks over a freed page can resolve to non-existent or non-RAM physical addresses, producing machine checks, oopses, or otherwise unpredictable CPU behavior that panics the machine. Any resulting translation corruption also crashes the affected process and kernel." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/include/asm/tlbflush.h" ], "versions": [ { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "618d5612ecb7bfc1c85342daafeb2b47e29e77a3", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "556d446068f90981e5d71ca686bdaccdd545d491", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "0708fd6bd8161871bfbadced2ca4319b84ab44fe", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "7085895c59e4057ffae17f58990ccb630087d0d2", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "93224deb50a8d20df3884f3672ce9f982129aa50", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "320ac1af4c0bdb92c864dc9250d1329234820edf", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be", "status": "affected", "versionType": "git" }, { "version": "016c4d92cd16f569c6485ae62b076c1a4b779536", "lessThan": "3ef938c3503563bfc2ac15083557f880d29c2e64", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/include/asm/tlbflush.h" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.292", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.236", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.180", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.134", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.87", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.23", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.11", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.292" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.236" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.180" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.134" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.87" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.13.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.14.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3" }, { "url": "https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491" }, { "url": "https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1" }, { "url": "https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44fe" }, { "url": "https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2" }, { "url": "https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50" }, { "url": "https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edf" }, { "url": "https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be" }, { "url": "https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64" } ], "title": "x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:41:30.092Z" } } ] } }