| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs |
| |
| On the following path, flush_tlb_range() can be used for zapping normal |
| PMD entries (PMD entries that point to page tables) together with the PTE |
| entries in the pointed-to page table: |
| |
| collapse_pte_mapped_thp |
| pmdp_collapse_flush |
| flush_tlb_range |
| |
| The arm64 version of flush_tlb_range() has a comment describing that it can |
| be used for page table removal, and does not use any last-level |
| invalidation optimizations. Fix the X86 version by making it behave the |
| same way. |
| |
| Currently, X86 only uses this information for the following two purposes, |
| which I think means the issue doesn't have much impact: |
| |
| - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be |
| IPI'd to avoid issues with speculative page table walks. |
| - In Hyper-V TLB paravirtualization, again for lazy TLB stuff. |
| |
| The patch "x86/mm: only invalidate final translations with INVLPGB" which |
| is currently under review (see |
| <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) |
| would probably be making the impact of this a lot worse. |
| |
| The Linux kernel CVE team has assigned CVE-2025-22045 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 5.4.292 with commit 618d5612ecb7bfc1c85342daafeb2b47e29e77a3 |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 5.10.236 with commit 556d446068f90981e5d71ca686bdaccdd545d491 |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 5.15.180 with commit 0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1 |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 6.1.134 with commit 0708fd6bd8161871bfbadced2ca4319b84ab44fe |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 6.6.87 with commit 7085895c59e4057ffae17f58990ccb630087d0d2 |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 6.12.23 with commit 93224deb50a8d20df3884f3672ce9f982129aa50 |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 6.13.11 with commit 320ac1af4c0bdb92c864dc9250d1329234820edf |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 6.14.2 with commit 78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be |
| Issue introduced in 4.20 with commit 016c4d92cd16f569c6485ae62b076c1a4b779536 and fixed in 6.15 with commit 3ef938c3503563bfc2ac15083557f880d29c2e64 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-22045 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/x86/include/asm/tlbflush.h |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3 |
| https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491 |
| https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1 |
| https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44fe |
| https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2 |
| https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50 |
| https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edf |
| https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be |
| https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64 |
