In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2025062836-CVE-2025-38085-8075@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:13590 https://access.redhat.com/errata/RHSA-2025:13590
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:13589 https://access.redhat.com/errata/RHSA-2025:13589
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:13598 https://access.redhat.com/errata/RHSA-2025:13598
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:13962 https://access.redhat.com/errata/RHSA-2025:13962
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2025:14985 https://access.redhat.com/errata/RHSA-2025:14985
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2025:15224 https://access.redhat.com/errata/RHSA-2025:15224
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2025:15227 https://access.redhat.com/errata/RHSA-2025:15227
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:15647 https://access.redhat.com/errata/RHSA-2025:15647
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:15658 https://access.redhat.com/errata/RHSA-2025:15658
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2025:15660 https://access.redhat.com/errata/RHSA-2025:15660
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:15668 https://access.redhat.com/errata/RHSA-2025:15668
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:15670 https://access.redhat.com/errata/RHSA-2025:15670