{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38084", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.981Z", "datePublished": "2025-06-28T07:44:25.379Z", "dateUpdated": "2026-08-05T11:59:22.391Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:22.391Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: unshare page tables during VMA split, not before\n\nCurrently, __split_vma() triggers hugetlb page table unsharing through\nvm_ops->may_split(). This happens before the VMA lock and rmap locks are\ntaken - which is too early, it allows racing VMA-locked page faults in our\nprocess and racing rmap walks from other processes to cause page tables to\nbe shared again before we actually perform the split.\n\nFix it by explicitly calling into the hugetlb unshare logic from\n__split_vma() in the same place where THP splitting also happens. At that\npoint, both the VMA and the rmap(s) are write-locked.\n\nAn annoying detail is that we can now call into the helper\nhugetlb_unshare_pmds() from two different locking contexts:\n\n1. from hugetlb_split(), holding:\n - mmap lock (exclusively)\n - VMA lock\n - file rmap lock (exclusively)\n2. hugetlb_unshare_all_pmds(), which I think is designed to be able to\n call us with only the mmap lock held (in shared mode), but currently\n only runs while holding mmap lock (exclusively) and VMA lock\n\nBackporting note:\nThis commit fixes a racy protection that was introduced in commit\nb30c14cd6102 (\"hugetlb: unshare some PMDs when splitting VMAs\"); that\ncommit claimed to fix an issue introduced in 5.13, but it should actually\nalso go all the way back.\n\n[jannh@google.com: v2]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The race is driven entirely through local syscalls — `mmap(MAP_SHARED|MAP_HUGETLB)` plus `munmap`/`mprotect`/`madvise` to force a non-PUD-aligned `__split_vma()`, with concurrent threads faulting the mapping. No network or physical component is involved.\nAC:L - The attacker controls both sides of the race and the window is very wide — several sleeping GFP_KERNEL allocations sit between `may_split()` and `vma_start_write()` — and it can be retried indefinitely and widened with memory pressure. PMD sharing is compiled in by default on x86_64/arm64/riscv64, and the only environmental dependency (preallocated hugepages) is standard in the KVM/cloud, database and DPDK deployments this code targets.\nPR:L - An ordinary unprivileged user can create the required VM_MAYSHARE hugetlb mapping, because `mmap(MAP_ANONYMOUS|MAP_HUGETLB)` uses `HUGETLB_ANONHUGE_INODE` and therefore bypasses the `can_do_hugetlb_shm()`/`CAP_IPC_LOCK` check that guards SysV `SHM_HUGETLB`; `fork()` supplies the second sharing VMA. No capability is needed for the splitting syscalls either.\nUI:N - The whole sequence is performed programmatically by the attacker's own multi-threaded process; no victim action or interaction is required.\nS:U - The corrupted page tables belong to the attacking process's own mm within the host kernel's security authority, so this is standard local kernel compromise rather than a crossing of a VM/IOMMU boundary.\nC:H - A freed page-table page that is still referenced by a live PUD entry is the classic \"dirty pagetable\" primitive — once reallocated, the attacker can read arbitrary physical memory, disclosing kernel data and other processes' memory in full.\nI:H - The same page-table UAF yields an arbitrary physical-memory write primitive (writing PTEs into a reused page table), enabling kernel data modification, credential overwrite and full privilege escalation; it also leaves dangling KVM MMU mappings.\nA:H - Use-after-free of page tables reliably corrupts the memory management state, producing oopses, BUG_ON hits and kernel panics even in unsuccessful exploitation attempts, and it can be triggered repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/hugetlb.h", "mm/hugetlb.c", "mm/vma.c", "tools/testing/vma/vma_internal.h" ], "versions": [ { "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "e8847d18cd9fff1edbb45e963d9141273c3b539c", "status": "affected", "versionType": "git" }, { "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "366298f2b04d2bf1f2f2b7078405bdf9df9bd5d0", "status": "affected", "versionType": "git" }, { "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "2511ac64bc1617ca716d3ba8464e481a647c1902", "status": "affected", "versionType": "git" }, { "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "af6cfcd0efb7f051af221c418ec8b37a10211947", "status": "affected", "versionType": "git" }, { "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b", "status": "affected", "versionType": "git" }, { "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "8a21d5584826f4880f45bbf8f72375f4e6c0ff2a", "status": "affected", "versionType": "git" }, { "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "081056dc00a27bccb55ccc3c6f230a3d5fd3f7e0", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/hugetlb.h", "mm/hugetlb.c", "mm/vma.c", "tools/testing/vma/vma_internal.h" ], "versions": [ { "version": "2.6.20", "status": "affected" }, { "version": "0", "lessThan": "2.6.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "5.10.239" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "5.15.186" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.1.142" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.6.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.12.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.15.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e8847d18cd9fff1edbb45e963d9141273c3b539c" }, { "url": "https://git.kernel.org/stable/c/366298f2b04d2bf1f2f2b7078405bdf9df9bd5d0" }, { "url": "https://git.kernel.org/stable/c/2511ac64bc1617ca716d3ba8464e481a647c1902" }, { "url": "https://git.kernel.org/stable/c/af6cfcd0efb7f051af221c418ec8b37a10211947" }, { "url": "https://git.kernel.org/stable/c/9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b" }, { "url": "https://git.kernel.org/stable/c/8a21d5584826f4880f45bbf8f72375f4e6c0ff2a" }, { "url": "https://git.kernel.org/stable/c/081056dc00a27bccb55ccc3c6f230a3d5fd3f7e0" }, { "url": "https://project-zero.issues.chromium.org/issues/420715744" } ], "title": "mm/hugetlb: unshare page tables during VMA split, not before", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:52.441Z" } } ] } }