{"api_version":"1","generated_at":"2026-10-15T12:26:17+00:00","cve":"CVE-2025-22045","urls":{"html":"https://cve.report/CVE-2025-22045","api":"https://cve.report/api/cve/CVE-2025-22045.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-22045","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-22045"},"summary":{"title":"x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Fix flush_tlb_range() when used for zapping normal PMDs\n\nOn the following path, flush_tlb_range() can be used for zapping normal\nPMD entries (PMD entries that point to page tables) together with the PTE\nentries in the pointed-to page table:\n\n    collapse_pte_mapped_thp\n      pmdp_collapse_flush\n        flush_tlb_range\n\nThe arm64 version of flush_tlb_range() has a comment describing that it can\nbe used for page table removal, and does not use any last-level\ninvalidation optimizations. Fix the X86 version by making it behave the\nsame way.\n\nCurrently, X86 only uses this information for the following two purposes,\nwhich I think means the issue doesn't have much impact:\n\n - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be\n   IPI'd to avoid issues with speculative page table walks.\n - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.\n\nThe patch \"x86/mm: only invalidate final translations with INVLPGB\" which\nis currently under review (see\n<https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>)\nwould probably be making the impact of this a lot worse.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-04-16 15:15:57","updated_at":"2026-07-30 06:22:05"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","name":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64","name":"https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2","name":"https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491","name":"https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3","name":"https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edf","name":"https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edf","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1","name":"https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44fe","name":"https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44fe","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be","name":"https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","name":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50","name":"https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22045","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22045","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 618d5612ecb7bfc1c85342daafeb2b47e29e77a3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 556d446068f90981e5d71ca686bdaccdd545d491 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 0708fd6bd8161871bfbadced2ca4319b84ab44fe git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 7085895c59e4057ffae17f58990ccb630087d0d2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 93224deb50a8d20df3884f3672ce9f982129aa50 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 320ac1af4c0bdb92c864dc9250d1329234820edf git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 016c4d92cd16f569c6485ae62b076c1a4b779536 3ef938c3503563bfc2ac15083557f880d29c2e64 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.20","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.292 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.236 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.180 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.134 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.87 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.23 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.13.11 6.13.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14.2 6.14.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.15 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"22045","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T19:41:30.092Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/include/asm/tlbflush.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"618d5612ecb7bfc1c85342daafeb2b47e29e77a3","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"556d446068f90981e5d71ca686bdaccdd545d491","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"0708fd6bd8161871bfbadced2ca4319b84ab44fe","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"7085895c59e4057ffae17f58990ccb630087d0d2","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"93224deb50a8d20df3884f3672ce9f982129aa50","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"320ac1af4c0bdb92c864dc9250d1329234820edf","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"},{"lessThan":"3ef938c3503563bfc2ac15083557f880d29c2e64","status":"affected","version":"016c4d92cd16f569c6485ae62b076c1a4b779536","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/include/asm/tlbflush.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.292","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.236","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.180","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.134","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.87","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.23","versionType":"semver"},{"lessThanOrEqual":"6.13.*","status":"unaffected","version":"6.13.11","versionType":"semver"},{"lessThanOrEqual":"6.14.*","status":"unaffected","version":"6.14.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.15","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.292","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.236","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.180","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.134","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.87","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.23","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.11","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.14.2","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.15","versionStartIncluding":"4.20","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Fix flush_tlb_range() when used for zapping normal PMDs\n\nOn the following path, flush_tlb_range() can be used for zapping normal\nPMD entries (PMD entries that point to page tables) together with the PTE\nentries in the pointed-to page table:\n\n    collapse_pte_mapped_thp\n      pmdp_collapse_flush\n        flush_tlb_range\n\nThe arm64 version of flush_tlb_range() has a comment describing that it can\nbe used for page table removal, and does not use any last-level\ninvalidation optimizations. Fix the X86 version by making it behave the\nsame way.\n\nCurrently, X86 only uses this information for the following two purposes,\nwhich I think means the issue doesn't have much impact:\n\n - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be\n   IPI'd to avoid issues with speculative page table walks.\n - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.\n\nThe patch \"x86/mm: only invalidate final translations with INVLPGB\" which\nis currently under review (see\n<https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>)\nwould probably be making the impact of this a lot worse."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-07-30T05:48:01.824Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3"},{"url":"https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491"},{"url":"https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1"},{"url":"https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44fe"},{"url":"https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2"},{"url":"https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50"},{"url":"https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edf"},{"url":"https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be"},{"url":"https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64"}],"title":"x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-22045","datePublished":"2025-04-16T14:12:05.849Z","dateReserved":"2024-12-29T08:45:45.810Z","dateUpdated":"2026-07-30T05:48:01.824Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-04-16 15:15:57","lastModifiedDate":"2026-07-30 06:22:05","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.4.292","matchCriteriaId":"E7271250-7637-4B0D-9535-6DD3E4AF3DD4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.236","matchCriteriaId":"1DF46FB0-9163-4ABE-8CCA-32A497D4715B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.180","matchCriteriaId":"D19801C8-3D18-405D-9989-E6C9B30255FA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.134","matchCriteriaId":"3985DEC3-0437-4177-BC42-314AB575285A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.87","matchCriteriaId":"EFF24260-49B1-4251-9477-C564CFDAD25B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.23","matchCriteriaId":"26CAB76D-F00F-43CE-BEAD-7097F8FB1D6C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.13.11","matchCriteriaId":"E7E864B0-8C00-4679-BA55-659B4C9C3AD3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.14.2","matchCriteriaId":"FADAE5D8-4808-442C-B218-77B2CE8780A0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"22045","Ordinal":"1","Title":"x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs","CVE":"CVE-2025-22045","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"22045","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Fix flush_tlb_range() when used for zapping normal PMDs\n\nOn the following path, flush_tlb_range() can be used for zapping normal\nPMD entries (PMD entries that point to page tables) together with the PTE\nentries in the pointed-to page table:\n\n    collapse_pte_mapped_thp\n      pmdp_collapse_flush\n        flush_tlb_range\n\nThe arm64 version of flush_tlb_range() has a comment describing that it can\nbe used for page table removal, and does not use any last-level\ninvalidation optimizations. Fix the X86 version by making it behave the\nsame way.\n\nCurrently, X86 only uses this information for the following two purposes,\nwhich I think means the issue doesn't have much impact:\n\n - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be\n   IPI'd to avoid issues with speculative page table walks.\n - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.\n\nThe patch \"x86/mm: only invalidate final translations with INVLPGB\" which\nis currently under review (see\n<https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>)\nwould probably be making the impact of this a lot worse.","Type":"Description","Title":"x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs"}]}}}