x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and suppresses the flush. Fix it by widening the window where should_flush_tlb() sends an IPI. Long Version: === History === There were a few things leading up to this. First, updating mm_cpumask() was observed to be too expensive, so it was made lazier. But being lazy caused too many unnecessary IPIs to CPUs due to the now-lazy mm_cpumask(). So code was added to cull mm_cpumask() periodically[2]. But that culling was a bit too aggressive and skipped sending TLB flushes to CPUs that need them. So here we are again. === Problem === The too-aggressive code in should_flush_tlb() strikes in this window: // Turn on IPIs for this CPU/mm combination, but only // if should_flush_tlb() agrees: cpumask_set_cpu(cpu, mm_cpumask(next)); next_tlb_gen = atomic64_read(&next->context.tlb_gen); choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush); load_new_mm_cr3(need_flush); // ^ After 'need_flush' is set to false, IPIs *MUST* // be sent to this CPU and not be ignored. this_cpu_write(cpu_tlbstate.loaded_mm, next); // ^ Not until this point does should_flush_tlb() // become true! should_flush_tlb() will suppress TLB flushes between load_new_mm_cr3() and writing to 'loaded_mm', which is
CVE-2025-37964
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-37964
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "848b5815177582de0e1d0118725378e0fbadca20",
"lessThan": "12f703811af043d32b1c8a30001b2fa04d5cd0ac",
"versionType": "git"
},
{
"status": "affected",
"version": "b47002ed65ade940839b7f439ff4a194e7d5ec28",
"lessThan": "02ad4ce144bd27f71f583f667fdf3b3ba0753477",
"versionType": "git"
},
{
"status": "affected",
"version": "a04fe3bfc71e28009e20357b79df1e8ef7c9d600",
"lessThan": "d41072906abec8bb8e01ed16afefbaa558908c89",
"versionType": "git"
},
{
"status": "affected",
"version": "3dbe889a1b829b4c07e0836ff853fe649e51ce4f",
"lessThan": "d87392094f96e162fa5fa5a8640d70cc0952806f",
"versionType": "git"
},
{
"status": "affected",
"version": "6db2526c1d694c91c6e05e2f186c085e9460f202",
"lessThan": "399ec9ca8fc4999e676ff89a90184ec40031cf59",
"versionType": "git"
},
{
"status": "affected",
"version": "6db2526c1d694c91c6e05e2f186c085e9460f202",
"lessThan": "fea4e317f9e7e1f449ce90dedc27a2d2a95bee5a",
"versionType": "git"
},
{
"status": "affected",
"version": "d1347977661342cb09a304a17701eb2d4aa21dec",
"versionType": "git"
},
{
"status": "affected",
"version": "5.15.179",
"lessThan": "5.15.183",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.129",
"lessThan": "6.1.139",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.79",
"lessThan": "6.6.91",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.16",
"lessThan": "6.12.29",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.13.4",
"lessThan": "6.14",
"versionType": "semver"
}
],
"programFiles": [
"arch/x86/mm/tlb.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.183",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.139",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.91",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.29",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.14.7",
"versionType": "semver",
"lessThanOrEqual": "6.14.*"
},
{
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/x86/mm/tlb.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-37964
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #27008 · Revision 1
- Added to Heist Feed
- Publisher date