Security readout for executives and security teams
Plain-English summary
A Linux x86 memory-management flaw may leave processor translation caches insufficiently cleared when certain page tables are removed. Exploitation requires local, low-privileged access; it is not described as remotely exploitable. Although scored 7.8, the kernel report says current impact appears limited.
Executive priority
Treat this as a scheduled high-priority kernel update, accelerated for shared x86 systems permitting untrusted local execution. It does not justify an internet-wide emergency response based on the supplied evidence, because access is local, active exploitation is not established, and the kernel description qualifies current impact as limited.
Technical view
During collapse_pte_mapped_thp, x86 flush_tlb_range() could zap a normal PMD and its PTEs without page-table-removal semantics. This affects lazy-TLB CPU notification and Hyper-V TLB paravirtualization behavior. Stable kernel commits change x86 invalidation to match arm64’s broader handling.
Likely exposure
Potentially exposed systems run affected x86 Linux kernels and permit untrusted local code or accounts. Hyper-V-hosted Linux workloads may warrant additional attention. The supplied version data does not provide complete distribution-package mappings, so administrators must verify exposure through their kernel or distribution vendor.
Exploitation context
The CVSS 3.1 score is 7.8 with local access and low privileges required. The supplied record is not in KEV and provides no evidence of active exploitation or a public working exploit. The original technical description characterizes present impact as limited but warns that later invalidation optimizations could worsen it.
Researcher notes
Key review areas are normal-PMD removal, speculative page-table walks on lazy-TLB CPUs, and Hyper-V paravirtualized invalidation. The source warns that a separately reviewed INVLPGB optimization could increase impact, but the bundle does not establish that change as deployed or affected. No exploitability demonstration or detailed failure outcome is supplied.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the cited stable fix.
- Reboot after installation so the corrected kernel is running.
- Prioritize x86 multi-user systems and Hyper-V Linux workloads.
- If updates are unavailable, restrict untrusted local access and consult vendor guidance.
Validation and detection
- Inventory running kernels, architectures, distribution packages, and virtualization environments.
- Compare each kernel package against its vendor advisory and cited stable fix.
- After reboot, confirm the active kernel is the corrected package.
- Document systems whose vendor has not supplied definitive affected-version mapping.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22045 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/618d5612ecb7bfc1c85342daafeb2b47e29e77a3CVE reference, Linux
- https://git.kernel.org/stable/c/556d446068f90981e5d71ca686bdaccdd545d491CVE reference, Linux
- https://git.kernel.org/stable/c/0a8f806ea6b5dd64b3d1f05ff774817d5f7ddbd1CVE reference, Linux
- https://git.kernel.org/stable/c/0708fd6bd8161871bfbadced2ca4319b84ab44feCVE reference, Linux
- https://git.kernel.org/stable/c/7085895c59e4057ffae17f58990ccb630087d0d2CVE reference, Linux
- https://git.kernel.org/stable/c/93224deb50a8d20df3884f3672ce9f982129aa50CVE reference, Linux
- https://git.kernel.org/stable/c/320ac1af4c0bdb92c864dc9250d1329234820edfCVE reference, Linux
- https://git.kernel.org/stable/c/78d6f9a9eb2a5da6fcbd76d6191d24b0dcc321beCVE reference, Linux
- https://git.kernel.org/stable/c/3ef938c3503563bfc2ac15083557f880d29c2e64CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.