CVE-2025-38084: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38084 is a vulnerability discovered in the Linux kernel affecting the memory management subsystem, specifically related to huge page table handling during VMA (Virtual Memory Area) splits. The vulnerability was disclosed on June 28, 2025 (NVD, Wiz).

The vulnerability exists in the Linux kernel's memory management subsystem where splitvma() triggers hugetlb page table unsharing through vmops->maysplit(). The issue occurs because this operation happens before the VMA lock and rmap locks are taken, which is too early in the process. This timing allows racing VMA-locked page faults in the process and racing rmap walks from other processes to cause page tables to be shared again before the actual split is performed (NVD).

The vulnerability affects multiple versions of the Linux kernel and is currently marked as vulnerable in various distributions including bullseye, bookworm, trixie, and sid (Wiz).

The fix involves explicitly calling into the hugetlb unshare logic from splitvma() in the same location where THP splitting occurs, ensuring both the VMA and the rmap(s) are write-locked during the operation (NVD).