https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:38:23 +0000 https://cve.radiocsirt.org/vuln/cve-2025-38085 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race</p> <p>huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.</p> <p>If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don&#39;t see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.</p> <p>Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race</p> <p>huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.</p> <p>If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don&#39;t see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.</p> <p>Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.</p> https://cve.radiocsirt.org/vuln/cve-2025-38085