CVE-2025-37964

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Eliminate window where TLB flushes may be inadvertently skipped

tl;dr: There is a window in the mm switching code where the new CR3 is

set and the CPU should be getting TLB flushes for the new mm. But

should_flush_tlb() has a bug and suppresses the flush. Fix it by

widening the window where should_flush_tlb() sends an IPI.

Long Version:

=== History ===

There were a few things leading up to this.

First, updating mm_cpumask() was observed to be too expensive, so it was

made lazier. But being lazy caused too many unnecessary IPIs to CPUs

due to the now-lazy mm_cpumask(). So code was added to cull

mm_cpumask() periodically[2]. But that culling was a bit too aggressive

and skipped sending TLB flushes to CPUs that need them. So here we are

again.

=== Problem ===

The too-aggressive code in should_flush_tlb() strikes in this window:

// Turn on IPIs for this CPU/mm combination, but only

// if should_flu

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References