CVE-2025-22034

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs

Patch series "mm: fixes for device-exclusive entries (hmm)", v2.

Discussing the PageTail() call in make_device_exclusive_range() with

Willy, I recently discovered [1] that device-exclusive handling does not

properly work with THP, making the hmm-tests selftests fail if THPs are

enabled on the system.

Looking into more details, I found that hugetlb is not properly fenced,

and I realized that something that was bugging me for longer -- how

device-exclusive entries interact with mapcounts -- completely breaks

migration/swapout/split/hwpoison handling of these folios while they have

device-exclusive PTEs.

The program below can be used to allocate 1 GiB worth of pages and making

them device-exclusive on a kernel with CONFIG_TEST_HMM.

Once they are device-exclusive, these folios cannot get swapped out

(proc$pid/smaps_rollup will always indicate 1 GiB RSS no matter how muc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References