[LTS 8.6] CVE-2025-38085, CVE-2025-38022, CVE-2025-38129

[pvts-mat]

[LTS 8.6]

CVE-2025-38085	VULN-71581
CVE-2025-38022	VULN-71148
CVE-2025-38129	VULN-71833

CVE-2025-38085

Situation

Commit 1013af4 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race is identified as the fix for CVE-2025-38085. However, it depends on a function tlb_remove_table_sync_one which is not defined in LTS 8.6. It was introduced in 0d6e24d asm-generic/tlb: provide MMU_GATHER_TABLE_FREE. No solution to CVE-2025-38085 was found which didn't have this commit in place:

• centos9 12a6db3,
• centos10 41f7eb5,
• rocky9_6 2872192,
• rocky8_10 e2c95cd,
• rocky10_0 68b3612,
• linux-5.10.y: 952596b08c74e8fe9e2883d1dc8a8f54a37384ec,
• linux-5.15.y: a3d864c901a300c295692d129159fc3001a56185,
• linux-6.1.y: b7754d3aa7bf9f62218d096c0c8f6c13698fac8b,
• linux-6.6.y: fe684290418ef9ef76630072086ee530b92f02b8,
• linux-6.12.y: 034a52b,
• linux-6.15.y: a6bfeb97941a9187833b526bc6cc4ff5706d0ce9,

although also none of those solutions had 0d6e24d backported as part of it.

The commit 0d6e24d asm-generic/tlb: provide MMU_GATHER_TABLE_FREE introduces a new option, but it's not user-selectable; rather, it's used in the configuration as part of architecture's features makeup, eg. as in (implied by):

kernel-src-tree/arch/arm64/Kconfig

Line 247 in 1013af4

select MMU_GATHER_RCU_TABLE_FREE

The commit therefore doesn't introduce a new feature but addresses the hardare setup not accounted for sufficiently before:

This however leaves architectures that don't have page based directories
but don't need RCU in a bind. For those, provide MMU_GATHER_TABLE_FREE,
which provides the independent batching for directories without the
additional RCU freeing.

Nevertheless backporting it may seem risky and simply ad-hoc defining the one line long tlb_remove_table_sync_one may be preferred. However, the definition of tlb_remove_table_sync_one function used in CVE-2025-38085 depends on an option. For CONFIG_MMU_GATHER_RCU_TABLE_FREE:

kernel-src-tree/mm/mmu_gather.c

Lines 142 to 152 in 0d6e24d

	static void tlb_remove_table_sync_one(void)
	{
	/*
	* This isn't an RCU grace period and hence the page-tables cannot be
	* assumed to be actually RCU-freed.
	*
	* It is however sufficient for software page-table walkers that rely on
	* IRQ disabling.
	*/
	smp_call_function(tlb_remove_table_smp_sync, NULL, 1);
	}

For !CONFIG_MMU_GATHER_RCU_TABLE_FREE:

kernel-src-tree/mm/mmu_gather.c

Line 166 in 0d6e24d

static void tlb_remove_table_sync_one(void) { }

In the upstream the tlb_remove_table_one function is expressed by tlb_remove_table_sync_one:

kernel-src-tree/mm/mmu_gather.c

Lines 190 to 194 in 0d6e24d

	static void tlb_remove_table_one(void *table)
	{
	tlb_remove_table_sync_one();
	__tlb_remove_table(table);
	}

If it was defined like that in LTS 8.6 as well then its definition would start depending on CONFIG_MMU_GATHER_RCU_TABLE_FREE too, which would change code semantics in an uncontrolled manner. Putting it under control by following 0d6e24d's options dependency would boil down to simply backporting that commit. Not expressing tlb_remove_table_one by tlb_remove_table_sync_one, on the other hand, would lead to code duplication and enigmatic deviation from the upstream. It was therefore decided to backport 0d6e24d asm-generic/tlb: provide MMU_GATHER_TABLE_FREE despite some complications it implied.

That commit depends on options naming scheme not yet backported to LTS 8.6:

Old	New	Renaming ocmmit
`HAVE_RCU_TABLE_FREE`	`MMU_GATHER_RCU_TABLE_FREE`	ff2e6d7
`HAVE_MMU_GATHER_PAGE_SIZE`	`MMU_GATHER_PAGE_SIZE`	3af4bd0
`HAVE_MMU_GATHER_NO_GATHER`	`MMU_GATHER_NO_GATHER`	580a586
-	`MMU_GATHER_TABLE_FREE`	0d6e24d

The renaming was done in a bulk, right before 0d6e24d:

git log --oneline -n 4 0d6e24d430ef23280d8dea0ba1faeefc66c26a57

0d6e24d430ef23280d8dea0ba1faeefc66c26a57 asm-generic/tlb: provide MMU_GATHER_TABLE_FREE
580a586c409ab3040b7284a19cd9e281692c40c7 asm-generic/tlb: rename HAVE_MMU_GATHER_NO_GATHER
3af4bd033759c4dab4f0ff594f0aa1e8d182b9d7 asm-generic/tlb: rename HAVE_MMU_GATHER_PAGE_SIZE
ff2e6d7259f82ccc9a5aaa7f41194161d9262392 asm-generic/tlb: rename HAVE_RCU_TABLE_FREE

Between sticking to an old scheme and using the new one the latter was chosen, because it made tha backporting much simpler, less prone to mistakes and it avoided devising a completely unique option name HAVE_MMU_GATHER_TABLE_FREE. Only the MMU_GATHER_NO_GATHER option was renamed though, to simplify the bug fix. This introduced some option naming inconsistency, but it's not a big problem.

All other commits in the CVE-2025-38085 fix are preparing the code for either the option renaming done in 580a586 asm-generic/tlb: rename HAVE_MMU_GATHER_NO_GATHER, or for prviding the MMU_GATHER_TABLE_FREE option with the required tlb_remove_table_sync_one function in 0d6e24d asm-generic/tlb: provide MMU_GATHER_TABLE_FREE.

Finally, the CVE-2025-38085 fix 1013af4 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race includes the exposition of tlb_remove_table_sync_one, which in the upstream was done in a similar fix 2ba99c5 mm/khugepaged: fix GUP-fast interaction by sending IPI, not backported to LTS 8.6.

Commits

mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

jira VULN-71581
cve CVE-2025-38085
commit-author Jann Horn <jannh@google.com>
commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d
upstream-diff |
  - Context conflicts due to missing
    59d9094df3d79443937add8700b2ef1a866b1081 ("mm: hugetlb: independent
    PMD page table shared count").
  - Exposed the `tlb_remove_table_sync_one' function for use in the
    solution (missing 2ba99c5e08812494bc57f319fb562f527d9bacd8
    ("mm/khugepaged: fix GUP-fast interaction by sending IPI")).

The CVE-2025-38085 fixing commit. Compared to the upstream the tlb_remove_table_sync_one function was made public as part of the fix.

asm-generic/tlb: provide MMU_GATHER_TABLE_FREE

jira VULN-71581
cve-pre CVE-2025-38085
commit-author Peter Zijlstra <peterz@infradead.org>
commit 0d6e24d430ef23280d8dea0ba1faeefc66c26a57
upstream-diff |
  include/asm-generic/tlb.h
        Small conflict in the comments
  mm/mmu_gather.c
        - Context conflict in tlb_flush_mmu_free because
          580a586c409ab3040b7284a19cd9e281692c40c7 ("asm-generic/tlb:
          rename HAVE_MMU_GATHER_NO_GATHER") wasn't backported and
          CONFIG_MMU_GATHER_NO_GATHER still has its old name
          CONFIG_HAVE_MMU_GATHER_NO_GATHER.
        - Context conflict in tlb_gather_mmu because
          3af4bd033759c4dab4f0ff594f0aa1e8d182b9d7 ("asm-generic/tlb:
          rename HAVE_MMU_GATHER_PAGE_SIZE") wasn't backported and
          CONFIG_MMU_GATHER_PAGE_SIZE still has its old name
          CONFIG_HAVE_MMU_GATHER_PAGE_SIZE.

This commit provides the necessary options for the tlb_remove_table_sync_one function to be defined properly. The new option MMU_GATHER_TABLE_FREE is not user-selectable and it doesn't introduce a new feature. Rather it can be thought of as fine-tuning the existing solution.

asm-generic/tlb: rename HAVE_RCU_TABLE_FREE

jira VULN-71581
cve-pre CVE-2025-38085
commit-author Peter Zijlstra <peterz@infradead.org>
commit ff2e6d7259f82ccc9a5aaa7f41194161d9262392
upstream-diff |
  arch/arm64/Kconfig
        Context conflicts due to options HAVE_FUTEX_CMPXCHG,
        HAVE_FUNCTION_ARG_ACCESS_API not yet introduced into LTS 8.6.
  arch/x86/Kconfig
        Context conflicts due to the option HAVE_RCU_TABLE_INVALIDATE
        still being in LTS 8.6, but no longer in the upstream

Code refactoring commit, functionally neutral. Backporting it significantly reduces conflict in backporting the main CVE-2025-38085 prerequisite 0d6e24d asm-generic/tlb: provide MMU_GATHER_TABLE_FREE.

arm/tlb: Convert to generic mmu_gather

jira VULN-71581
cve-pre CVE-2025-38085
commit-author Peter Zijlstra <peterz@infradead.org>
commit b78180b97dcf667350aac716cd3f32356eaf4984

This commit massively simplifies the arch/arm/include/asm/tlb.h, easing the backport of 0d6e24d asm-generic/tlb: provide MMU_GATHER_TABLE_FREE. Important note from the commit's message:

No change in behavior intended.

ARM: Kconfig: remove useless parenthesis

jira VULN-71581
cve-pre CVE-2025-38085
commit-author Russell King <rmk+kernel@armlinux.org.uk>
commit f00790aaf2e240f57d19dab39e07f0ab87c6d95c

Similarly to the commit above this one prepares the codebase for the cherry pick of ff2e6d7 asm-generic/tlb: rename HAVE_RCU_TABLE_FREE. Functionally neutral.

arm/asm/tlb.h: Fix build error implicit func declaration

jira VULN-71581
cve-pre CVE-2025-38085
commit-author Anders Roxell <anders.roxell@linaro.org>
commit 063daa8129f94d651c4d30a8333b577c5bbf8090

This commit is just a small and cheap prerequisite to make clean the cherry pick of b78180b arm/tlb: Convert to generic mmu_gather. Functionally neutral.

CVE-2025-38022

RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

jira VULN-71148
cve CVE-2025-38022
commit-author Zhu Yanjun <yanjun.zhu@linux.dev>
commit d0706bfd3ee40923c001c6827b786a309e2a8713
upstream-diff Used linux-5.15.y backport
  5629064f92f0de6d6b3572055cd35361c3ad953c for the clean pick. In LTS 8.6
  the `ib_device_notify_register()' function, where the `kobject_uevent()'
  call was moved in the upstream fix, doesn't exist. It was introduced in
  9cbed5aab5aeea420d0aa945733bf608449d44fb ("RDMA/nldev: Add support for
  RDMA monitoring"), with locks put in place in
  1d6a9e7449e2a0c1e2934eee7880ba8bd1e464cd ("RDMA/core: Fix use-after-free
  when rename device name"). Wrapping the `kobject_uevent()' call in
  `down_read(&devices_rwsem)' and `up_read(&devices_rwsem)' results in the
  same protection.

For details see the explanation of the solution to LTS 9.2 (same situation)

CVE-2025-38129

page_pool: Fix use-after-free in page_pool_recycle_in_ring

jira VULN-71833
cve CVE-2025-38129
commit-author Dong Chenchen <dongchenchen2@huawei.com>
commit 271683bb2cf32e5126c592b5d5e6a756fa374fd9
upstream-diff Used linux-5.15.y backport
  d69f28ef7cdafdcf37ee310f38b1399e7d05f9a8 for a clean pick. It accounts
  for the similarly non-backported commit
  4dec64c52e24c2c9a15f81c115f1be5ea35121cb ("page_pool: convert to use
  netmem") and deals with the same context conflicts in
  `page_pool_release()', as well as with the multiple context conflicts
  before the `page_pool_producer_lock()' definition (mostly non-
  backported stats functionality).

page_pool: fix inconsistency for page_pool_ring_[un]lock()

jira VULN-71833
cve-pre CVE-2025-38129
commit-author Yunsheng Lin <linyunsheng@huawei.com>
commit 368d3cb406cdd074d1df2ad9ec06d1bfcb664882
upstream-diff Context conflicts resolved, no actual diffs from the
  upstream

net: page_pool: use in_softirq() instead

jira VULN-71833
cve-pre CVE-2025-38129
commit-author Qingfang DENG <qingfang.deng@siflower.com.cn>
commit 542bcea4be866b14b3a5c8e90773329066656c43

For details see the explanation of the solution to LTS 9.2 (similar situation)

kABI check: passed

[0/1] kabi_check_kernel	Check ABI of kernel [ciqlts8_6-CVE-batch-39]	_kabi_check_kernel__x86_64--test--ciqlts8_6-CVE-batch-39
ninja explain: output state/kernels/ciqlts8_6-CVE-batch-39/x86_64/kabi_checked doesn't exist
ninja explain: state/kernels/ciqlts8_6-CVE-batch-39/x86_64/kabi_checked is dirty
+ dist_git_version=el-8.6
+ local_version=ciqlts8_6-CVE-batch-39
+ arch=x86_64
+ user=pvts
+ buildmachine=x86_64--build--ciqlts8_6
+ virsh_timeout=600
+ ssh_daemon_wait=20
+ src_dir=/mnt/code/kernel-dist-git-el-8.6
+ build_dir=/mnt/build_files/kernel-src-tree-ciqlts8_6-CVE-batch-39
+ sudo chmod +x /data/src/ctrliq-github-haskell/kernel-dist-git-el-8.6/SOURCES/check-kabi
+ ninja-back/virssh.xsh --max 8 --shutdown-on-success --shutdown-on-failure --timeout 600 --ssh-daemon-wait 20 pvts x86_64--build--ciqlts8_6 ''\''/mnt/code/kernel-dist-git-el-8.6/SOURCES/check-kabi'\'' -k '\''/mnt/code/kernel-dist-git-el-8.6/SOURCES/Module.kabi_x86_64'\'' -s '\''/mnt/build_files/kernel-src-tree-ciqlts8_6-CVE-batch-39/Module.symvers'\'''
kABI check passed
+ touch state/kernels/ciqlts8_6-CVE-batch-39/x86_64/kabi_checked

Boot test: passed

boot-test.log

Kselftests: passed rleative

Reference

kselftests–ciqlts8_6–run1.log

Patch

kselftests–ciqlts8_6-CVE-batch-39–run1.log

Comparison

The tests results for the reference and the patch are the same.

$ ktests.xsh diff -d kselftests*.log

Column    File
--------  --------------------------------------------
Status0   kselftests--ciqlts8_6--run1.log
Status1   kselftests--ciqlts8_6-CVE-batch-39--run1.log

full-test-results-comparison.log