CVE-2025-38085

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugepmdunshare() vs GUP-fast race

hugepmdunshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.

If this happens in the middle of a concurrent gupfast(), gupfast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.

Fix it with an explicit broadcast IPI through tlbremovetablesyncone(), just like we do in khugepaged when removing page tables for a THP collapse.