CVE-2025-38085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38085", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.981Z", "datePublished": "2025-06-28T07:44:26.178Z", "dateUpdated": "2026-08-05T11:59:23.457Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:23.457Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\n\nhuge_pmd_unshare() drops a reference on a page table that may have\npreviously been shared across processes, potentially turning it into a\nnormal page table used in another process in which unrelated VMAs can\nafterwards be installed.\n\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\nend up walking the page tables of another process. While I don't see any\nway in which that immediately leads to kernel memory corruption, it is\nreally weird and unexpected.\n\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\njust like we do in khugepaged when removing page tables for a THP\ncollapse."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is driven entirely through local syscalls \u2014 a PUD-aligned MAP_SHARED hugetlbfs/MAP_HUGETLB mapping plus munmap/mremap/mprotect/fallocate to trigger huge_pmd_unshare(), raced against gup_fast() reached via O_DIRECT, io_uring registered buffers or vmsplice. There is no network-facing path into mm/hugetlb.c.\nAC:L - The attacker controls every participant: one thread issues the GUP-fast pin, a sibling thread issues the unmap that calls huge_pmd_unshare(), and a second attacker process reuses the now-exclusively-owned PMD table, and the whole sequence can be looped indefinitely. The gup_fast() IRQ-disabled window can additionally be widened by requesting a full PUD-sized pin range, since the PUD is latched once at the start of gup_fast_pud_range() while the PMD loop then walks 512 entries.\nPR:L - hugetlb_file_setup() performs no capable() check for MAP_HUGETLB anonymous mappings, and none of huge_pmd_unshare()'s callers or the GUP-fast entry points require any capability, so an ordinary local user account suffices. Only a configured hugepage pool is needed, which is standard on cloud, virtualization, DPDK and database hosts.\nUI:N - Exploitation is fully self-contained \u2014 the attacker forks its own second process to establish PMD sharing and to repurpose the unshared page table. No victim action is required at any point.\nS:U - The defect and its impact are both within the kernel's own memory-management security authority, with no VM, IOMMU or sandbox boundary crossed. This is a standard kernel memory-safety/privilege-escalation shape, so scope remains Unchanged.\nC:H - A gup_fast() walker that latched the stale PUD proceeds to walk a PMD table that now backs a different process's address space, pinning and returning struct pages that belong to that other mm. Handing those pages to O_DIRECT or vmsplice yields a direct read primitive against another process's memory, which on hosts where a hugetlbfs segment is shared across trust boundaries (QEMU/vhost-user, DPDK/SPDK, shared DB segments) discloses privileged data.\nI:H - The same stale walk with FOLL_WRITE returns writable pins on pages mapped by the foreign address space, so an O_DIRECT read or io_uring write into that buffer modifies another process's memory arbitrarily. It also leaves DMA pins and page reference/mapcount state established behind the back of the owning mm, corrupting page-table and pinning invariants the kernel relies on.\nA:H - GUP-fast traversing page tables of an unrelated address space while that process is concurrently tearing down and re-populating them is exactly the unsynchronized page-table access the kernel elsewhere prevents with tlb_remove_table_sync_one(), and it readily produces inconsistent refcount/mapcount state, VM_WARN/BUG trips, and oops in mm paths. The race can be re-armed in a loop by an unprivileged process."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/hugetlb.c"], "versions": [{"version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "952596b08c74e8fe9e2883d1dc8a8f54a37384ec", "status": "affected", "versionType": "git"}, {"version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "a3d864c901a300c295692d129159fc3001a56185", "status": "affected", "versionType": "git"}, {"version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "b7754d3aa7bf9f62218d096c0c8f6c13698fac8b", "status": "affected", "versionType": "git"}, {"version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "fe684290418ef9ef76630072086ee530b92f02b8", "status": "affected", "versionType": "git"}, {"version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "034a52b5ef57c9c8225d94e9067f3390bb33922f", "status": "affected", "versionType": "git"}, {"version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "a6bfeb97941a9187833b526bc6cc4ff5706d0ce9", "status": "affected", "versionType": "git"}, {"version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "1013af4f585fccc4d3e5c5824d174de2257f7d6d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/hugetlb.c"], "versions": [{"version": "2.6.20", "status": "affected"}, {"version": "0", "lessThan": "2.6.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "5.10.239"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "5.15.186"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.1.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.6.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.12.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.15.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec"}, {"url": "https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185"}, {"url": "https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b"}, {"url": "https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8"}, {"url": "https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f"}, {"url": "https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9"}, {"url": "https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d"}, {"url": "https://project-zero.issues.chromium.org/issues/420715744"}], "title": "mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:54.315Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38085", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T20:41:29.670838Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T18:44:12.999Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:54.315Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38085", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T20:41:29.670838Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T17:38:25.112Z"}}], "cna": {"title": "mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is driven entirely through local syscalls \u2014 a PUD-aligned MAP_SHARED hugetlbfs/MAP_HUGETLB mapping plus munmap/mremap/mprotect/fallocate to trigger huge_pmd_unshare(), raced against gup_fast() reached via O_DIRECT, io_uring registered buffers or vmsplice. There is no network-facing path into mm/hugetlb.c.\nAC:L - The attacker controls every participant: one thread issues the GUP-fast pin, a sibling thread issues the unmap that calls huge_pmd_unshare(), and a second attacker process reuses the now-exclusively-owned PMD table, and the whole sequence can be looped indefinitely. The gup_fast() IRQ-disabled window can additionally be widened by requesting a full PUD-sized pin range, since the PUD is latched once at the start of gup_fast_pud_range() while the PMD loop then walks 512 entries.\nPR:L - hugetlb_file_setup() performs no capable() check for MAP_HUGETLB anonymous mappings, and none of huge_pmd_unshare()'s callers or the GUP-fast entry points require any capability, so an ordinary local user account suffices. Only a configured hugepage pool is needed, which is standard on cloud, virtualization, DPDK and database hosts.\nUI:N - Exploitation is fully self-contained \u2014 the attacker forks its own second process to establish PMD sharing and to repurpose the unshared page table. No victim action is required at any point.\nS:U - The defect and its impact are both within the kernel's own memory-management security authority, with no VM, IOMMU or sandbox boundary crossed. This is a standard kernel memory-safety/privilege-escalation shape, so scope remains Unchanged.\nC:H - A gup_fast() walker that latched the stale PUD proceeds to walk a PMD table that now backs a different process's address space, pinning and returning struct pages that belong to that other mm. Handing those pages to O_DIRECT or vmsplice yields a direct read primitive against another process's memory, which on hosts where a hugetlbfs segment is shared across trust boundaries (QEMU/vhost-user, DPDK/SPDK, shared DB segments) discloses privileged data.\nI:H - The same stale walk with FOLL_WRITE returns writable pins on pages mapped by the foreign address space, so an O_DIRECT read or io_uring write into that buffer modifies another process's memory arbitrarily. It also leaves DMA pins and page reference/mapcount state established behind the back of the owning mm, corrupting page-table and pinning invariants the kernel relies on.\nA:H - GUP-fast traversing page tables of an unrelated address space while that process is concurrently tearing down and re-populating them is exactly the unsynchronized page-table access the kernel elsewhere prevents with tlb_remove_table_sync_one(), and it readily produces inconsistent refcount/mapcount state, VM_WARN/BUG trips, and oops in mm paths. The race can be re-armed in a loop by an unprivileged process."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "952596b08c74e8fe9e2883d1dc8a8f54a37384ec", "versionType": "git"}, {"status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "a3d864c901a300c295692d129159fc3001a56185", "versionType": "git"}, {"status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "b7754d3aa7bf9f62218d096c0c8f6c13698fac8b", "versionType": "git"}, {"status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "fe684290418ef9ef76630072086ee530b92f02b8", "versionType": "git"}, {"status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "034a52b5ef57c9c8225d94e9067f3390bb33922f", "versionType": "git"}, {"status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "a6bfeb97941a9187833b526bc6cc4ff5706d0ce9", "versionType": "git"}, {"status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "lessThan": "1013af4f585fccc4d3e5c5824d174de2257f7d6d", "versionType": "git"}], "programFiles": ["mm/hugetlb.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.20"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.20", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.239", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.186", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.142", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.95", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.35", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.4", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/hugetlb.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec"}, {"url": "https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185"}, {"url": "https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b"}, {"url": "https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8"}, {"url": "https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f"}, {"url": "https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9"}, {"url": "https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d"}, {"url": "https://project-zero.issues.chromium.org/issues/420715744"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\n\nhuge_pmd_unshare() drops a reference on a page table that may have\npreviously been shared across processes, potentially turning it into a\nnormal page table used in another process in which unrelated VMAs can\nafterwards be installed.\n\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\nend up walking the page tables of another process. While I don't see any\nway in which that immediately leads to kernel memory corruption, it is\nreally weird and unexpected.\n\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\njust like we do in khugepaged when removing page tables for a THP\ncollapse."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.239", "versionStartIncluding": "2.6.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.186", "versionStartIncluding": "2.6.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.142", "versionStartIncluding": "2.6.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.95", "versionStartIncluding": "2.6.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.35", "versionStartIncluding": "2.6.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.4", "versionStartIncluding": "2.6.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "2.6.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:23.457Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38085", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:59:23.457Z", "dateReserved": "2025-04-16T04:51:23.981Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-06-28T07:44:26.178Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/hugetlb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "952596b08c74e8fe9e2883d1dc8a8f54a37384ec", "status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "versionType": "git"}, {"lessThan": "a3d864c901a300c295692d129159fc3001a56185", "status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "versionType": "git"}, {"lessThan": "b7754d3aa7bf9f62218d096c0c8f6c13698fac8b", "status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "versionType": "git"}, {"lessThan": "fe684290418ef9ef76630072086ee530b92f02b8", "status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "versionType": "git"}, {"lessThan": "034a52b5ef57c9c8225d94e9067f3390bb33922f", "status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "versionType": "git"}, {"lessThan": "a6bfeb97941a9187833b526bc6cc4ff5706d0ce9", "status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "versionType": "git"}, {"lessThan": "1013af4f585fccc4d3e5c5824d174de2257f7d6d", "status": "affected", "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/hugetlb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.20"}, {"lessThan": "2.6.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.239", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.186", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.142", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.95", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.35", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1EE21F6F-2600-42F4-93A9-ACB07AC4B055", "versionEndExcluding": "5.10.239", "versionStartIncluding": "2.6.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D96F2C0D-0D4A-4658-AD34-D8A626EA422D", "versionEndExcluding": "5.15.186", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "459B4E94-FE0E-434D-B782-95E3A5FFC6B1", "versionEndExcluding": "6.1.142", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5E01853-7048-4D78-9479-9AEE41AC8456", "versionEndExcluding": "6.6.95", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E569FD34-0076-4428-BE17-EECCF867611C", "versionEndExcluding": "6.12.35", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFD174C5-1AA2-4671-BDDC-1A9FCC753655", "versionEndExcluding": "6.15.4", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\n\nhuge_pmd_unshare() drops a reference on a page table that may have\npreviously been shared across processes, potentially turning it into a\nnormal page table used in another process in which unrelated VMAs can\nafterwards be installed.\n\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\nend up walking the page tables of another process. While I don't see any\nway in which that immediately leads to kernel memory corruption, it is\nreally weird and unexpected.\n\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\njust like we do in khugepaged when removing page tables for a THP\ncollapse."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/hugetlb: correcci\u00f3n de huge_pmd_unshare() frente a la competencia GUP-fast. huge_pmd_unshare() elimina una referencia en una tabla de p\u00e1ginas que podr\u00eda haber sido compartida previamente entre procesos, lo que podr\u00eda convertirla en una tabla de p\u00e1ginas normal utilizada por otro proceso en la que posteriormente se podr\u00edan instalar VMAs no relacionadas. Si esto ocurre durante una ejecuci\u00f3n simult\u00e1nea de gup_fast(), gup_fast() podr\u00eda terminar recorriendo las tablas de p\u00e1ginas de otro proceso. Si bien no veo ninguna forma en que esto provoque inmediatamente una corrupci\u00f3n de memoria en el kernel, es realmente extra\u00f1o e inesperado. Corr\u00edjalo con una IPI de difusi\u00f3n expl\u00edcita a trav\u00e9s de tlb_remove_table_sync_one(), tal como hacemos en khugepaged al eliminar tablas de p\u00e1ginas durante un colapso de THP."}], "id": "CVE-2025-38085", "lastModified": "2026-07-30T06:22:49.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38085", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T20:41:29.670838Z", "version": "2.0.3"}}]}, "published": "2025-06-28T08:15:24.843", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Third Party Advisory"], "url": "https://project-zero.issues.chromium.org/issues/420715744"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race", "id": "2375304", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2375304"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-200", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\nhuge_pmd_unshare() drops a reference on a page table that may have\npreviously been shared across processes, potentially turning it into a\nnormal page table used in another process in which unrelated VMAs can\nafterwards be installed.\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\nend up walking the page tables of another process. While I don't see any\nway in which that immediately leads to kernel memory corruption, it is\nreally weird and unexpected.\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\njust like we do in khugepaged when removing page tables for a THP\ncollapse."], "name": "CVE-2025-38085", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38085\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38085\nhttps://lore.kernel.org/linux-cve-announce/2025062836-CVE-2025-38085-8075@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-06T22:16:30.967610+00:00", "updated": "2025-07-06T22:16:30.967690+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}