Cloudanix VulnDB

CVE-2025-37964

None

CVSS

—

EPSS

0.2%

Published

May 20, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux manages memory address translations on some processors can let attackers read or change data they should not be able to access until the operating system is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in x86 mm switching allows should_flush_tlb() to suppress required TLB flushes between load_new_mm_cr3() and the subsequent write to cpu_tlbstate.loaded_mm, leaving stale TLB entries for the new address space.

Why it matters to the business

Linux systems may experience memory corruption, crashes, or unauthorized memory access after context switches, increasing risk of downtime or data exposure on servers and devices until kernels are updated.

How an attack unfolds

An attacker triggers rapid mm switches or concurrent TLB activity to hit the narrow window where the new CR3 is loaded yet should_flush_tlb() still returns false, allowing use of stale translations that can be abused in privilege-escalation chains with other kernel flaws.

How to fix it

Upgrade Linux kernel to 5.15.183 or later stable releases containing commit 12f703811af043d32b1c8a30001b2fa04d5cd0ac; rebuild and reboot all affected hosts.

How to confirm the fix worked

Confirm kernel version is at or above the fixed releases; inspect switch_mm_irqs_off() and should_flush_tlb() for the LOADED_MM_SWITCHING check and barrier; run targeted TLB-flush stress tests post-upgrade.

Typical attack path

  1. Identify or create conditions for frequent address-space switches on the target CPU
  2. Race the mm-switch window to suppress a needed TLB flush
  3. Leverage resulting stale TLB entry for memory-access or corruption primitive
  4. Chain with other kernel issues for privilege escalation or container escape

How to detect it

Review kernel logs and crash dumps for unexpected TLB-related faults or corruption after context switches; correlate with process creation or namespace switch events on systems running vulnerable kernels.

What your security team should do

  • Prioritize kernel updates on internet-facing and multi-tenant systems within standard patch windows
  • Monitor EPSS and KEV status for any future increase in exploit activity
  • Include the fixed commit in automated kernel build and deployment pipelines
  • Review container and VM isolation assumptions until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and suppresses the flush. Fix it by widening the window where should_flush_tlb() sends an IPI. Long Version: === History === There were a few things leading up to this. First, updating mm_cpumask() was observed to be too expensive, so it was made lazier. But being lazy caused too many unnecessary IPIs to CPUs due to the now-lazy mm_cpumask(). So code was added to cull mm_cpumask() periodically[2]. But that culling was a bit too aggressive and skipped sending TLB flushes to CPUs that need them. So here we are again. === Problem === The too-aggressive code in should_flush_tlb() strikes in this window: // Turn on IPIs for this CPU/mm combination, but only // if should_flush_tlb() agrees: cpumask_set_cpu(cpu, mm_cpumask(next)); next_tlb_gen = atomic64_read(&next->context.tlb_gen); choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush); load_new_mm_cr3(need_flush); // ^ After 'need_flush' is set to false, IPIs *MUST* // be sent to this CPU and not be ignored. this_cpu_write(cpu_tlbstate.loaded_mm, next); // ^ Not until this point does should_flush_tlb() // become true! should_flush_tlb() will suppress TLB flushes between load_new_mm_cr3() and writing to 'loaded_mm', which is a window where they should not be suppressed. Whoops. === Solution === Thankfully, the fuzzy "just about to write CR3" window is already marked with loaded_mm==LOADED_MM_SWITCHING. Simply checking for that state in should_flush_tlb() is sufficient to ensure that the CPU is targeted with an IPI. This will cause more TLB flush IPIs. But the window is relatively small and I do not expect this to cause any kind of measurable performance impact. Update the comment where LOADED_MM_SWITCHING is written since it grew yet another user. Peter Z also raised a concern that should_flush_tlb() might not observe 'loaded_mm' and 'is_lazy' in the same order that switch_mm_irqs_off() writes them. Add a barrier to ensure that they are observed in the order they are written.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux-6.1 0 6.1.140-1~deb11u1
Debian:12 linux 0 6.1.140-1
Debian:13 linux 0 No fix
Debian:13 linux 0 6.12.29-1
Debian:14 linux 0 6.12.29-1
Linux Kernel 0 5.15.183
Mageia:9 dwarves 0 1.30-1.mga9
Mageia:9 kernel 0 6.6.93-1.mga9
Mageia:9 kernel-firmware 0 20250509-1.mga9
Mageia:9 kernel-firmware-nonfree 0 20250509-1.mga9.nonfree
Mageia:9 kernel-linus 0 6.6.93-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.8-3.mga9
Mageia:9 kmod-xtables-addons 0 3.24-80.mga9
Mageia:9 libtraceevent 0 1.8.4-1.mga9
Mageia:9 libtracefs 0 1.8.2-1.mga9
Mageia:9 radeon-firmware 0 20250509-1.mga9.nonfree
Mageia:9 wireless-regdb 0 20250220-1.mga9

Related vulnerabilities