CVE-2025-22045 x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
Incorrect TLB flushing in the Linux kernel x86 memory management code could lead to stale page table entries, potentially causing system instability or security issues.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22045?
CVE-2025-22045 is a high-severity vulnerability in Linux kernel, published on 16 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table:
collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range
The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way.
Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact:
- In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.
The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see <https://lore.kernel.org/all/[email protected]/>) would probably be making the impact of this a lot worse.
Which versions are affected by CVE-2025-22045?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-22045?
Apply the vendor's patch.
Is CVE-2025-22045 being exploited?
There is no known exploitation of CVE-2025-22045 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-22045, DEBIAN-CVE-2025-22045, GHSA-pghg-fxcf-g9f9, ROOT-OS-UBUNTU-2404-CVE-2025-22045, UBUNTU-CVE-2025-22045.