CVE-2025-40174

Vulnerability

In the Linux kernel's x86 memory management code, the function switch_mm_irqs_off() is responsible for switching the memory context during a process context switch. A missing smp_mb() (smp memory barrier) between the store to loaded_mm and the load of tlb_gen means that the ordering guarantees required for correct TLB flushing are not enforced. This allows a scenario where switch_mm() may fail to observe a recent update to tlb_gen from a concurrent flush_tlb_mm_range() operation.

Exploitation

The vulnerability is a CPU memory ordering issue that can be exploited by an unprivileged local attacker. By triggering a race condition between a context switch and a TLB flush on another CPU, the attacker can cause the TLB to retain stale entries. No special authentication or network access is required; the attacker only needs the ability to execute code on the system and induce the necessary timing.

Impact

If the TLB is not properly flushed, the processor may use outdated page table entries. This can lead to incorrect memory accesses, potentially allowing an attacker to read sensitive kernel memory or cause a use-after-free condition. The exact impact depends on the system configuration and the attacker's ability to control the race window.

Mitigation

The issue has been fixed in the Linux kernel stable tree via commits [1] and [2]. Users should update to a kernel version that includes these patches. No workaround is available other than applying the fix.