{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-37964", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-37964", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2025-05-20T16:01:56.013Z", "updatedAt": "2026-10-15T01:06:18.215Z", "importedAt": "2026-10-24T01:57:34.152Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "x86/mm: Eliminate window where TLB flushes may be inadvertently skipped", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Eliminate window where TLB flushes may be inadvertently skipped\n\ntl;dr: There is a window in the mm switching code where the new CR3 is\nset and the CPU should be getting TLB flushes for the new mm. But\nshould_flush_tlb() has a bug and suppresses the flush. Fix it by\nwidening the window where should_flush_tlb() sends an IPI.\n\nLong Version:\n\n=== History ===\n\nThere were a few things leading up to this.\n\nFirst, updating mm_cpumask() was observed to be too expensive, so it was\nmade lazier. But being lazy caused too many unnecessary IPIs to CPUs\ndue to the now-lazy mm_cpumask(). So code was added to cull\nmm_cpumask() periodically[2]. But that culling was a bit too aggressive\nand skipped sending TLB flushes to CPUs that need them. So here we are\nagain.\n\n=== Problem ===\n\nThe too-aggressive code in should_flush_tlb() strikes in this window:\n\n\t// Turn on IPIs for this CPU/mm combination, but only\n\t// if should_flush_tlb() agrees:\n\tcpumask_set_cpu(cpu, mm_cpumask(next));\n\n\tnext_tlb_gen = atomic64_read(&next->context.tlb_gen);\n\tchoose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);\n\tload_new_mm_cr3(need_flush);\n\t// ^ After 'need_flush' is set to false, IPIs *MUST*\n\t// be sent to this CPU and not be ignored.\n\n this_cpu_write(cpu_tlbstate.loaded_mm, next);\n\t// ^ Not until this point does should_flush_tlb()\n\t// become true!\n\nshould_flush_tlb() will suppress TLB flushes between load_new_mm_cr3()\nand writing to 'loaded_mm', which is a window where they should not be\nsuppressed. Whoops.\n\n=== Solution ===\n\nThankfully, the fuzzy \"just about to write CR3\" window is already marked\nwith loaded_mm==LOADED_MM_SWITCHING. Simply checking for that state in\nshould_flush_tlb() is sufficient to ensure that the CPU is targeted with\nan IPI.\n\nThis will cause more TLB flush IPIs. But the window is relatively small\nand I do not expect this to cause any kind of measurable performance\nimpact.\n\nUpdate the comment where LOADED_MM_SWITCHING is written since it grew\nyet another user.\n\nPeter Z also raised a concern that should_flush_tlb() might not observe\n'loaded_mm' and 'is_lazy' in the same order that switch_mm_irqs_off()\nwrites them. Add a barrier to ensure that they are observed in the\norder they are written.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "848b5815177582de0e1d0118725378e0fbadca20", "status": "affected", "versionType": "git", "lessThan": "12f703811af043d32b1c8a30001b2fa04d5cd0ac" }, { "version": "b47002ed65ade940839b7f439ff4a194e7d5ec28", "status": "affected", "versionType": "git", "lessThan": "02ad4ce144bd27f71f583f667fdf3b3ba0753477" }, { "version": "a04fe3bfc71e28009e20357b79df1e8ef7c9d600", "status": "affected", "versionType": "git", "lessThan": "d41072906abec8bb8e01ed16afefbaa558908c89" }, { "version": "3dbe889a1b829b4c07e0836ff853fe649e51ce4f", "status": "affected", "versionType": "git", "lessThan": "d87392094f96e162fa5fa5a8640d70cc0952806f" }, { "version": "6db2526c1d694c91c6e05e2f186c085e9460f202", "status": "affected", "versionType": "git", "lessThan": "399ec9ca8fc4999e676ff89a90184ec40031cf59" }, { "version": "6db2526c1d694c91c6e05e2f186c085e9460f202", "status": "affected", "versionType": "git", "lessThan": "fea4e317f9e7e1f449ce90dedc27a2d2a95bee5a" }, { "version": "d1347977661342cb09a304a17701eb2d4aa21dec", "status": "affected", "versionType": "git" }, { "version": "5.15.179", "status": "affected", "versionType": "semver", "lessThan": "5.15.183" }, { "version": "6.1.129", "status": "affected", "versionType": "semver", "lessThan": "6.1.139" }, { "version": "6.6.79", "status": "affected", "versionType": "semver", "lessThan": "6.6.91" }, { "version": "6.12.16", "status": "affected", "versionType": "semver", "lessThan": "6.12.29" }, { "version": "6.13.4", "status": "affected", "versionType": "semver", "lessThan": "6.14" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.14", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.14" }, { "version": "5.15.183", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.139", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.91", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.29", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.14.7", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.14.*" }, { "version": "6.15", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }