CVE-2025-38085

CVE-2025-38085 affects the Linux kernel and stems from a race condition within the `mm/hugetlb` subsystem, specifically concerning the `hugepmdunshare()` function's interaction with GUP-fast operations. The vulnerability occurs when `hugepmdunshare()` drops a reference on a page table that may have been previously shared across processes. This can potentially transform it into a normal page table used in another process where unrelated VMAs can be installed. If the above scenario happens during a concurrent `gupfast()` operation, `gupfast()` could end up walking the page tables of another process. While this does not immediately lead to kernel memory corruption, it introduces unexpected behavior in page table management that could potentially affect system stability and security. The suggested fix involves implementing an explicit broadcast IPI through `tlbremovetablesyncone()`, similar to the approach used in `khugepaged` when removing page tables for a THP collapse.