CVE-2025-22045

What it actually does

Incorrect TLB range flushing on x86 when zapping normal PMD entries via collapse_pte_mapped_thp and pmdp_collapse_flush paths, allowing stale translations and speculative page table walk issues.

Why it matters to the business

Potential kernel memory corruption or unauthorized access on x86 systems, raising risk of system instability or compromise in multi-CPU and virtualized environments despite currently limited impact.

How an attack unfolds

An attacker triggers the collapse_pte_mapped_thp path to invoke flush_tlb_range on PMD entries without proper last-level invalidation, exploiting the x86 implementation's optimization assumptions to create TLB inconsistencies.

How to fix it

Update affected packages to fixed versions: NetworkManager-libreswan and related components to 0:1.2.18-6.el9_4 on Red Hat rhel_eus 9.4, or apply Linux kernel commit 618d5612ecb7bfc1c85342daafeb2b47e29e77a3 from the stable GIT repository.

How to confirm the fix worked

Confirm package or kernel versions match the listed fixed releases; review TLB flush code paths post-update to ensure PMD zapping uses full invalidation.

Typical attack path

1. Trigger THP collapse on PTE-mapped pages
2. Invoke pmdp_collapse_flush to zap PMD and PTE entries
3. Call flush_tlb_range without full invalidation on x86
4. Exploit resulting stale TLB entries for speculative access or corruption

How to detect it

Review kernel logs for TLB-related warnings or panics during memory collapse operations; correlate with process activity involving huge pages.

What your security team should do

• Apply kernel and package updates immediately on x86 systems
• Monitor for future patches that could increase exploitability
• Audit multi-CPU and virtualized deployments for exposure