In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: unshare page tables during VMA split, not before
Currently, _splitvma() triggers hugetlb page table unsharing through vmops->maysplit(). This happens before the VMA lock and rmap locks are taken - which is too early, it allows racing VMA-locked page faults in our process and racing rmap walks from other processes to cause page tables to be shared again before we actually perform the split.
Fix it by explicitly calling into the hugetlb unshare logic from _splitvma() in the same place where THP splitting also happens. At that point, both the VMA and the rmap(s) are write-locked.
An annoying detail is that we can now call into the helper hugetlbunsharepmds() from two different locking contexts:
Backporting note: This commit fixes a racy protection that was introduced in commit b30c14cd6102 ("hugetlb: unshare some PMDs when splitting VMAs"); that commit claimed to fix an issue introduced in 5.13, but it should actually also go all the way back.
[jannh@google.com: v2]
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52753018898470947234547852128558835669",
"19804762647080691783230151253269792529",
"45190900138654685363003062086593929088",
"314182754796218852123890570185883811471",
"316196148941921527740683231443802703215",
"88048183399990507642651997134085282522",
"284203904781400879735685468407448189963",
"244355906654745782008770551376839728918",
"251398165595225282664375693647546659702",
"305952023751941954790134157539064690659",
"301519299238909534297127246312246711035",
"329853088662540062134129529398154957687",
"29333489994741674220523060441284126140",
"170986884457436217978329349739256444141",
"121568900234155171192242044957772173038",
"143002790075945917072412975054371912345",
"315593726508226396712821628284128965716",
"162639462850590038130368507753281273644",
"217034269103485266689340066554425438513",
"177123204813649874601245295809143826952",
"114691709069895103176212306352183470442",
"128888950859140515296567182775101161225",
"331955059544191435532753387482227005432",
"51432911281480823029582116149893932075",
"312161215527333093639530737576491448267",
"241583852224038902492235223745896311810",
"15895689586192901170444180268793671102",
"247587934777417644870404951657003840015",
"112688764340004607005664029233824780991",
"18776158144370828930069088091399233255",
"293842374840825023172712300019719908518",
"256616015382008679620414775452692133475",
"222794554934773362020084515652019518976",
"275531658001169229427294738751991574233",
"266491554746787897220437567922102477057"
]
},
"target": {
"file": "mm/hugetlb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2511ac64bc1617ca716d3ba8464e481a647c1902",
"id": "CVE-2025-38084-02cd8077",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"16482395250567930798030180312963545617",
"46277848181638888706478513210328140856",
"70807047247870718954078072885128665398",
"167314477880194268383860935059303238423",
"68284580743415959535630490478535969640"
]
},
"target": {
"file": "mm/mmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8847d18cd9fff1edbb45e963d9141273c3b539c",
"id": "CVE-2025-38084-08a3f37d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"105467619621433115023814004909719199301",
"6096636376509257295173385555258139325",
"106564838453330485085494248452973764311",
"100711336949344613283280660082909861044",
"290021074781353680877894076857185931756",
"38554714814853262706169969389305133625",
"84932464175689518698022990704934379443"
]
},
"target": {
"file": "include/linux/hugetlb.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2511ac64bc1617ca716d3ba8464e481a647c1902",
"id": "CVE-2025-38084-102ac766",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "209654011871918262019919361086587287349",
"length": 346.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_vm_op_split"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a21d5584826f4880f45bbf8f72375f4e6c0ff2a",
"id": "CVE-2025-38084-11a1b5cf",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "115078083141868912900571309766207401079",
"length": 835.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_unshare_pmds"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8847d18cd9fff1edbb45e963d9141273c3b539c",
"id": "CVE-2025-38084-1598d7ce",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "196767660793277384323256824745375672883",
"length": 869.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_unshare_pmds"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-400f1ea2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "261468813878203371621956207993410340223",
"length": 1561.0
},
"target": {
"file": "mm/vma.c",
"function": "__split_vma"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-556b41fe",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "138689939529549059816423353673093269393",
"length": 875.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_unshare_pmds"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2511ac64bc1617ca716d3ba8464e481a647c1902",
"id": "CVE-2025-38084-62d197fa",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"312442420014278028851184827878716417045",
"228596555951252854420271981023165798930",
"192443515571574227289333181957731899544",
"318770875326607997554423329710353437375",
"316196148941921527740683231443802703215",
"88048183399990507642651997134085282522",
"284203904781400879735685468407448189963",
"244355906654745782008770551376839728918",
"251398165595225282664375693647546659702",
"305952023751941954790134157539064690659",
"301519299238909534297127246312246711035",
"329853088662540062134129529398154957687",
"29333489994741674220523060441284126140",
"170986884457436217978329349739256444141",
"121568900234155171192242044957772173038",
"272845890639244546484986263382314089677",
"315593726508226396712821628284128965716",
"162639462850590038130368507753281273644",
"217034269103485266689340066554425438513",
"177123204813649874601245295809143826952",
"114691709069895103176212306352183470442",
"289363907569351696024405197356444921099",
"151424962152565203117464427410804944209",
"306951404062685056002673256303912523192",
"241583852224038902492235223745896311810",
"15895689586192901170444180268793671102",
"112240023958246297599205235038215906479",
"268850421659528173071959833058705668531",
"281761239270266283201661762462853097755"
]
},
"target": {
"file": "mm/hugetlb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8847d18cd9fff1edbb45e963d9141273c3b539c",
"id": "CVE-2025-38084-63ad0632",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304813724102455635529612926924816110835",
"72065434772112177746388597207553391046",
"154086542102524403662312971539969074331",
"228694458230093645827786402208052334203"
]
},
"target": {
"file": "mm/vma_internal.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-6bab5763",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112532034584404727137818162638594017903",
"195956271537503504919927925950355974528",
"77624006388905379965277358751665552126",
"100711336949344613283280660082909861044",
"290021074781353680877894076857185931756",
"239973198389849245901350440256267847024",
"203099027195039678932211151167048133082"
]
},
"target": {
"file": "include/linux/hugetlb.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-6ce1d2e6",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "196767660793277384323256824745375672883",
"length": 869.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_unshare_pmds"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a21d5584826f4880f45bbf8f72375f4e6c0ff2a",
"id": "CVE-2025-38084-89b1fc55",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"202543408667449053447507642450057237836",
"132409862702101831756138650940669907619",
"131270466686066411317816512651090404916",
"211561384995306118449270051349691223204",
"190831260507851753006132282788973801222",
"132284970789104498305241086575244388385",
"186038951940112413526543528086500733438"
]
},
"target": {
"file": "include/linux/hugetlb.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8847d18cd9fff1edbb45e963d9141273c3b539c",
"id": "CVE-2025-38084-8ca86fa9",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "209654011871918262019919361086587287349",
"length": 346.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_vm_op_split"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2511ac64bc1617ca716d3ba8464e481a647c1902",
"id": "CVE-2025-38084-8ce3657d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "231475504532329403536592516212064801901",
"length": 3796.0
},
"target": {
"file": "mm/mmap.c",
"function": "__vma_adjust"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2511ac64bc1617ca716d3ba8464e481a647c1902",
"id": "CVE-2025-38084-8f669068",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "169315895339561391751982350019948205187",
"length": 3233.0
},
"target": {
"file": "mm/mmap.c",
"function": "__vma_adjust"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8847d18cd9fff1edbb45e963d9141273c3b539c",
"id": "CVE-2025-38084-98e9ab7c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "258325748534413042883953953165304220749",
"length": 143.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_unshare_all_pmds"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2511ac64bc1617ca716d3ba8464e481a647c1902",
"id": "CVE-2025-38084-9f71b9ed",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242959675656792942595012423990663873215",
"36846320902866141983975480691152709530",
"197682634861682304129871512462152637533"
]
},
"target": {
"file": "tools/testing/vma/vma_internal.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a21d5584826f4880f45bbf8f72375f4e6c0ff2a",
"id": "CVE-2025-38084-a243d10f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224938628003968478620566361521857775090",
"25389145392910465257393266237774563639",
"281432313078730834890417793103559101049",
"149118618317883540890109022267779058936",
"265759930486576518108745466659431234943"
]
},
"target": {
"file": "mm/vma.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a21d5584826f4880f45bbf8f72375f4e6c0ff2a",
"id": "CVE-2025-38084-a4af37a5",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "258325748534413042883953953165304220749",
"length": 143.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_unshare_all_pmds"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-acc3e08d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52753018898470947234547852128558835669",
"19804762647080691783230151253269792529",
"146075580061425710673473535569759261217",
"329716510995225261988370279078361930939",
"316196148941921527740683231443802703215",
"88048183399990507642651997134085282522",
"284203904781400879735685468407448189963",
"244355906654745782008770551376839728918",
"251398165595225282664375693647546659702",
"305952023751941954790134157539064690659",
"301519299238909534297127246312246711035",
"329853088662540062134129529398154957687",
"29333489994741674220523060441284126140",
"170986884457436217978329349739256444141",
"121568900234155171192242044957772173038",
"307499133795867584134817047456611811040",
"338708082539455017441404170694481940585",
"162639462850590038130368507753281273644",
"217034269103485266689340066554425438513",
"177123204813649874601245295809143826952",
"114691709069895103176212306352183470442",
"67426599454297222183659141969459373219",
"331955059544191435532753387482227005432",
"51432911281480823029582116149893932075",
"140921895276680892171027142004139881172",
"101973773694335132217044260256249172000",
"15895689586192901170444180268793671102",
"247587934777417644870404951657003840015",
"112688764340004607005664029233824780991",
"18776158144370828930069088091399233255",
"293842374840825023172712300019719908518",
"256616015382008679620414775452692133475",
"222794554934773362020084515652019518976",
"112049419510742882588844488037145950149",
"179268372788196712926464221301133701241"
]
},
"target": {
"file": "mm/hugetlb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a21d5584826f4880f45bbf8f72375f4e6c0ff2a",
"id": "CVE-2025-38084-ba591200",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "209654011871918262019919361086587287349",
"length": 346.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_vm_op_split"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-c30217f5",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224938628003968478620566361521857775090",
"1035137279063837263718022783625397947",
"99815353764842361188335361531742363201",
"244400161420790212877133761394435241751",
"3113826295397245645005657330573526528"
]
},
"target": {
"file": "mm/vma.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-c48e7308",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"33118133640407889245784142764538527406",
"298021650839037910410248944407358604203",
"191403009144246647202564780918077311844",
"68284580743415959535630490478535969640"
]
},
"target": {
"file": "mm/mmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2511ac64bc1617ca716d3ba8464e481a647c1902",
"id": "CVE-2025-38084-c546de1f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"130970224640434760362666403547710870456",
"141578542937378658147205925790645433065",
"197682634861682304129871512462152637533"
]
},
"target": {
"file": "tools/testing/vma/vma_internal.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-ddb13824",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52753018898470947234547852128558835669",
"19804762647080691783230151253269792529",
"146075580061425710673473535569759261217",
"329716510995225261988370279078361930939",
"316196148941921527740683231443802703215",
"88048183399990507642651997134085282522",
"284203904781400879735685468407448189963",
"244355906654745782008770551376839728918",
"251398165595225282664375693647546659702",
"305952023751941954790134157539064690659",
"301519299238909534297127246312246711035",
"329853088662540062134129529398154957687",
"29333489994741674220523060441284126140",
"170986884457436217978329349739256444141",
"121568900234155171192242044957772173038",
"143002790075945917072412975054371912345",
"315593726508226396712821628284128965716",
"162639462850590038130368507753281273644",
"217034269103485266689340066554425438513",
"177123204813649874601245295809143826952",
"114691709069895103176212306352183470442",
"67426599454297222183659141969459373219",
"331955059544191435532753387482227005432",
"51432911281480823029582116149893932075",
"140921895276680892171027142004139881172",
"101973773694335132217044260256249172000",
"15895689586192901170444180268793671102",
"247587934777417644870404951657003840015",
"112688764340004607005664029233824780991",
"18776158144370828930069088091399233255",
"293842374840825023172712300019719908518",
"256616015382008679620414775452692133475",
"222794554934773362020084515652019518976",
"275531658001169229427294738751991574233",
"266491554746787897220437567922102477057"
]
},
"target": {
"file": "mm/hugetlb.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9cf5b2a3b72c23fb7b84736d5d19ee6ea718762b",
"id": "CVE-2025-38084-de1d335d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192309417969914016624927821406056196601",
"82300956447846671399969060656037289018",
"181898071222539158901068611180495764032",
"317290715802405697868647556482117299552",
"41192170041154122820017184101565313233",
"61236612375226329443203795549540813199",
"175219206152726969856010794867294582273"
]
},
"target": {
"file": "include/linux/hugetlb.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a21d5584826f4880f45bbf8f72375f4e6c0ff2a",
"id": "CVE-2025-38084-e2ed6921",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "209654011871918262019919361086587287349",
"length": 346.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_vm_op_split"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8847d18cd9fff1edbb45e963d9141273c3b539c",
"id": "CVE-2025-38084-e92ad9a7",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "258325748534413042883953953165304220749",
"length": 143.0
},
"target": {
"file": "mm/hugetlb.c",
"function": "hugetlb_unshare_all_pmds"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a21d5584826f4880f45bbf8f72375f4e6c0ff2a",
"id": "CVE-2025-38084-f4cf714d",
"deprecated": false,
"signature_version": "v1"
}
]