High 7.8Published Apr 16, 2025

CVE-2025-22045x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

Updated under an hour ago (Oct 26, 2026, 7:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-level invalidation optimizations. Fix the X86 version by making it behave the same way. Currently, X86 only uses this information for the following two purposes, which I think means the issue doesn't have much impact: - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be IPI'd to avoid issues with speculative page table walks. - In Hyper-V TLB paravirtualization, again for lazy TLB stuff. The patch "x86/mm: only invalidate final translations with INVLPGB" which is currently under review (see <https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>) would probably be making the impact of this a lot worse.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 016c4d92cd16f569c6485ae62b076c1a4b779536 before 618d5612ecb7bfc1c85342daafeb2b47e29e77a3; from 016c4d92cd16f569c6485ae62b076c1a4b779536 before 556d446068f90981e5d71ca686bdaccdd545d491; 016c4d92cd16f569c6485ae62b076c1a4b779536 builds before 0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1; from 016c4d92cd16f569c6485ae62b076c1a4b779536 before 0708fd6bd8161871bfbadced2ca4319b84ab44fe; from 016c4d92cd16f569c6485ae62b076c1a4b779536 before 7085895c59e4057ffae17f58990ccb630087d0d2; from 016c4d92cd16f569c6485ae62b076c1a4b779536 before 93224deb50a8d20df3884f3672ce9f982129aa50; from 016c4d92cd16f569c6485ae62b076c1a4b779536 before 320ac1af4c0bdb92c864dc9250d1329234820edf; from 016c4d92cd16f569c6485ae62b076c1a4b779536 before 78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.20 before 5.4.292; from 5.5 before 5.10.236; from 5.11 before 5.15.180; from 5.16 before 6.1.134; from 6.2 before 6.6.87; from 6.7 before 6.12.23; from 6.13 before 6.13.11; from 6.14 before 6.14.2	NVD

References

References

https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3	patch
https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491	patch
https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1	patch
https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44fe	patch
https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2	patch
https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50	patch
https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edf	patch
https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321be	patch
https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64	patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.