---
id: CVE-2025-22045
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

  On the following path, flush_tlb_range() can be used for zapping normal
  PMD entries (PMD entries that p…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

  On the following path, flush_tlb_range() can be used for zapping normal
  PMD entries (PMD entries that p…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.20, < 5.4.292'
  - 'linux_kernel >= 5.5, < 5.10.236'
  - 'linux_kernel >= 5.11, < 5.15.180'
  - 'linux_kernel >= 5.16, < 6.1.134'
  - 'linux_kernel >= 6.2, < 6.6.87'
  - 'linux_kernel >= 6.7, < 6.12.23'
  - 'linux_kernel >= 6.13, < 6.13.11'
  - 'linux_kernel >= 6.14, < 6.14.2'
patched:
  - linux_kernel 6.14.2
published: '2025-04-16'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:14.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-22045'
references:
  - url: 'https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44fe'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00239
epssPercentile: 0.1485
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:44:15.332696Z'
ingestedAt: '2026-10-15T22:48:25.474Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

On the following path, flush_tlb_range() can be used for zapping normal
PMD entries (PMD entries that point to page tables) together with the PTE
entries in the pointed-to page table:

    collapse_pte_mapped_thp
      pmdp_collapse_flush
        flush_tlb_range

The arm64 version of flush_tlb_range() has a comment describing that it can
be used for page table removal, and does not use any last-level
invalidation optimizations. Fix the X86 version by making it behave the
same way.

Currently, X86 only uses this information for the following two purposes,
which I think means the issue doesn't have much impact:

 - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be
   IPI'd to avoid issues with speculative page table walks.
 - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.

The patch "x86/mm: only invalidate final translations with INVLPGB" which
is currently under review (see
<https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>)
would probably be making the impact of this a lot worse.

## Affected

- `linux_kernel >= 4.20, < 5.4.292`
- `linux_kernel >= 5.5, < 5.10.236`
- `linux_kernel >= 5.11, < 5.15.180`
- `linux_kernel >= 5.16, < 6.1.134`
- `linux_kernel >= 6.2, < 6.6.87`
- `linux_kernel >= 6.7, < 6.12.23`
- `linux_kernel >= 6.13, < 6.13.11`
- `linux_kernel >= 6.14, < 6.14.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.14.2`