CVE-2025-38085 Affecting kernel-rt-debug package, versions <0:5.14.0-570.35.1.el9_6


Severity

Recommended
high

Based on AlmaLinux security rating.

Threat Intelligence

EPSS
0.04% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX9-KERNELRTDEBUG-12162034
  • published23 Aug 2025
  • disclosed18 Aug 2025

Introduced: 18 Aug 2025

NewCVE-2025-38085  (opens in a new tab)

How to fix?

Upgrade AlmaLinux:9 kernel-rt-debug to version 0:5.14.0-570.35.1.el9_6 or higher.
This issue was patched in ALSA-2025:13962.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug package and not the kernel-rt-debug package as distributed by AlmaLinux. See How to fix? for AlmaLinux:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed.

If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected.

Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.

CVSS Base Scores

version 3.1