CVE-2025-37885

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37885", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.963Z", "datePublished": "2025-05-09T06:45:48.150Z", "dateUpdated": "2026-10-15T21:52:02.387Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:02.551Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Reset IRTE to host control if *new* route isn't postable\n\nRestore an IRTE back to host control (remapped or posted MSI mode) if the\n*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of\nthe GSI routing type. Updating the IRTE if and only if the new GSI is an\nMSI results in KVM leaving an IRTE posting to a vCPU.\n\nThe dangling IRTE can result in interrupts being incorrectly delivered to\nthe guest, and in the worst case scenario can result in use-after-free,\ne.g. if the VM is torn down, but the underlying host IRQ isn't freed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered through the KVM_SET_GSI_ROUTING ioctl on a local VM file descriptor, requiring local access to /dev/kvm and a VFIO device node. No network-facing code path reaches the IRTE update logic.\nAC:L - A single KVM_SET_GSI_ROUTING call replacing an MSI route with any non-MSI routing type for a bypassed GSI deterministically leaves the IRTE dangling in posted mode; there is no race to win and no memory-layout condition outside the attacker's control needed to reach the bug.\nPR:L - No capability check exists anywhere on the path \u2014 only possession of the VM fd and a VFIO group fd, which is exactly the privilege set granted to an unprivileged QEMU process (user qemu/libvirt-qemu) on any cloud host doing PCI passthrough. This is also the position an attacker occupies after escaping the guest into the deliberately-sandboxed VMM process.\nUI:N - The attacker performs the entire sequence (bind irqfd, change GSI routing, tear down the VM, drive device interrupts) with no action required from any other user or victim.\nS:C - The dangling IRTE leaves an IOMMU interrupt-remapping entry under guest control, so device interrupts escape host authority \u2014 posted into a guest while the VM lives, and after teardown written by IOMMU hardware into physical memory that now belongs to a different security domain (host kernel or another VM). This is an interrupt-remapping/IOMMU isolation boundary bypass, not containment within a single authority.\nC:H - The use-after-free lets a guest receive host device interrupts it should never see, and the stale posted-interrupt descriptor target in reallocated kernel memory is leverageable for disclosure of host kernel memory contents to the attacker.\nI:H - After the vCPU/VM is freed, the IOMMU performs hardware writes (bit set in PIR at an attacker-chosen vector offset, plus the ON bit) into freed and reallocated kernel memory, giving a repeatable, timing-controlled write primitive into groomable slab objects \u2014 sufficient for control-flow hijack or privilege escalation.\nA:H - The use-after-free corrupts arbitrary reallocated kernel memory causing oops/panic, WARN_ON_ONCE(posted_vcpu) fires in the VT-d IRTE free path (panic under panic_on_warn), and the host permanently loses the device's interrupts."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/avic.c", "arch/x86/kvm/vmx/posted_intr.c"], "versions": [{"version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769", "status": "affected", "versionType": "git"}, {"version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "116c7d35b8f72eac383b9fd371d7c1a8ffc2968b", "status": "affected", "versionType": "git"}, {"version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "023816bd5fa46fab94d1e7917fe131b79ed1fb41", "status": "affected", "versionType": "git"}, {"version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "3481fd96d801715942b6f69fe251133128156f30", "status": "affected", "versionType": "git"}, {"version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "b5de7ac74f69603ad803c524b840bffd36368fc3", "status": "affected", "versionType": "git"}, {"version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "3066ec21d1a33896125747f68638725f456308db", "status": "affected", "versionType": "git"}, {"version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/avic.c", "arch/x86/kvm/vmx/posted_intr.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.237", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.181", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.136", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.89", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.237"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.181"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.89"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.14.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769"}, {"url": "https://git.kernel.org/stable/c/116c7d35b8f72eac383b9fd371d7c1a8ffc2968b"}, {"url": "https://git.kernel.org/stable/c/023816bd5fa46fab94d1e7917fe131b79ed1fb41"}, {"url": "https://git.kernel.org/stable/c/3481fd96d801715942b6f69fe251133128156f30"}, {"url": "https://git.kernel.org/stable/c/b5de7ac74f69603ad803c524b840bffd36368fc3"}, {"url": "https://git.kernel.org/stable/c/3066ec21d1a33896125747f68638725f456308db"}, {"url": "https://git.kernel.org/stable/c/9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2"}], "title": "KVM: x86: Reset IRTE to host control if *new* route isn't postable", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:56:59.413Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37885", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:46.467079Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:02.387Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:56:59.413Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37885", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:46.467079Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:45:46.930Z"}}], "cna": {"title": "KVM: x86: Reset IRTE to host control if *new* route isn't postable", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered through the KVM_SET_GSI_ROUTING ioctl on a local VM file descriptor, requiring local access to /dev/kvm and a VFIO device node. No network-facing code path reaches the IRTE update logic.\nAC:L - A single KVM_SET_GSI_ROUTING call replacing an MSI route with any non-MSI routing type for a bypassed GSI deterministically leaves the IRTE dangling in posted mode; there is no race to win and no memory-layout condition outside the attacker's control needed to reach the bug.\nPR:L - No capability check exists anywhere on the path \u2014 only possession of the VM fd and a VFIO group fd, which is exactly the privilege set granted to an unprivileged QEMU process (user qemu/libvirt-qemu) on any cloud host doing PCI passthrough. This is also the position an attacker occupies after escaping the guest into the deliberately-sandboxed VMM process.\nUI:N - The attacker performs the entire sequence (bind irqfd, change GSI routing, tear down the VM, drive device interrupts) with no action required from any other user or victim.\nS:C - The dangling IRTE leaves an IOMMU interrupt-remapping entry under guest control, so device interrupts escape host authority \u2014 posted into a guest while the VM lives, and after teardown written by IOMMU hardware into physical memory that now belongs to a different security domain (host kernel or another VM). This is an interrupt-remapping/IOMMU isolation boundary bypass, not containment within a single authority.\nC:H - The use-after-free lets a guest receive host device interrupts it should never see, and the stale posted-interrupt descriptor target in reallocated kernel memory is leverageable for disclosure of host kernel memory contents to the attacker.\nI:H - After the vCPU/VM is freed, the IOMMU performs hardware writes (bit set in PIR at an attacker-chosen vector offset, plus the ON bit) into freed and reallocated kernel memory, giving a repeatable, timing-controlled write primitive into groomable slab objects \u2014 sufficient for control-flow hijack or privilege escalation.\nA:H - The use-after-free corrupts arbitrary reallocated kernel memory causing oops/panic, WARN_ON_ONCE(posted_vcpu) fires in the VT-d IRTE free path (panic under panic_on_warn), and the host permanently loses the device's interrupts."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769", "versionType": "git"}, {"status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "116c7d35b8f72eac383b9fd371d7c1a8ffc2968b", "versionType": "git"}, {"status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "023816bd5fa46fab94d1e7917fe131b79ed1fb41", "versionType": "git"}, {"status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "3481fd96d801715942b6f69fe251133128156f30", "versionType": "git"}, {"status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "b5de7ac74f69603ad803c524b840bffd36368fc3", "versionType": "git"}, {"status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "3066ec21d1a33896125747f68638725f456308db", "versionType": "git"}, {"status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "lessThan": "9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2", "versionType": "git"}], "programFiles": ["arch/x86/kvm/svm/avic.c", "arch/x86/kvm/vmx/posted_intr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"status": "unaffected", "version": "0", "lessThan": "4.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.237", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.181", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.136", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.89", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.26", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.5", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kvm/svm/avic.c", "arch/x86/kvm/vmx/posted_intr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769"}, {"url": "https://git.kernel.org/stable/c/116c7d35b8f72eac383b9fd371d7c1a8ffc2968b"}, {"url": "https://git.kernel.org/stable/c/023816bd5fa46fab94d1e7917fe131b79ed1fb41"}, {"url": "https://git.kernel.org/stable/c/3481fd96d801715942b6f69fe251133128156f30"}, {"url": "https://git.kernel.org/stable/c/b5de7ac74f69603ad803c524b840bffd36368fc3"}, {"url": "https://git.kernel.org/stable/c/3066ec21d1a33896125747f68638725f456308db"}, {"url": "https://git.kernel.org/stable/c/9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Reset IRTE to host control if *new* route isn't postable\n\nRestore an IRTE back to host control (remapped or posted MSI mode) if the\n*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of\nthe GSI routing type. Updating the IRTE if and only if the new GSI is an\nMSI results in KVM leaving an IRTE posting to a vCPU.\n\nThe dangling IRTE can result in interrupts being incorrectly delivered to\nthe guest, and in the worst case scenario can result in use-after-free,\ne.g. if the VM is torn down, but the underlying host IRQ isn't freed."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.237", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.181", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.136", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.89", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.26", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.5", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "4.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:02.551Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37885", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:02.387Z", "dateReserved": "2025-04-16T04:51:23.963Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-09T06:45:48.150Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/avic.c", "arch/x86/kvm/vmx/posted_intr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769", "status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "versionType": "git"}, {"lessThan": "116c7d35b8f72eac383b9fd371d7c1a8ffc2968b", "status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "versionType": "git"}, {"lessThan": "023816bd5fa46fab94d1e7917fe131b79ed1fb41", "status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "versionType": "git"}, {"lessThan": "3481fd96d801715942b6f69fe251133128156f30", "status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "versionType": "git"}, {"lessThan": "b5de7ac74f69603ad803c524b840bffd36368fc3", "status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "versionType": "git"}, {"lessThan": "3066ec21d1a33896125747f68638725f456308db", "status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "versionType": "git"}, {"lessThan": "9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2", "status": "affected", "version": "efc644048ecde54f016011fe10110addd0de348f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/avic.c", "arch/x86/kvm/vmx/posted_intr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.237", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.181", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.136", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.89", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.26", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8CC08963-AAE0-435D-9F39-18AA77DB7476", "versionEndExcluding": "5.10.237", "versionStartIncluding": "4.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "12331C9E-F601-4EFC-899E-369F98DCC70B", "versionEndExcluding": "5.15.181", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "27735C1B-DDFC-4860-8952-1D01025F9D4C", "versionEndExcluding": "6.1.136", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D79CE030-3114-45E0-B52B-C77781BCB587", "versionEndExcluding": "6.6.89", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "22F52099-F422-4D19-8283-45F9F9BF4392", "versionEndExcluding": "6.12.26", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B25CA7E-4CD0-46DB-B4EF-13A3516071FB", "versionEndExcluding": "6.14.5", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Reset IRTE to host control if *new* route isn't postable\n\nRestore an IRTE back to host control (remapped or posted MSI mode) if the\n*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of\nthe GSI routing type. Updating the IRTE if and only if the new GSI is an\nMSI results in KVM leaving an IRTE posting to a vCPU.\n\nThe dangling IRTE can result in interrupts being incorrectly delivered to\nthe guest, and in the worst case scenario can result in use-after-free,\ne.g. if the VM is torn down, but the underlying host IRQ isn't freed."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86: Restablecer IRTE al control del host si la *nueva* ruta no se puede publicar. Restaurar un IRTE al control del host (modo MSI reasignado o publicado) si la *nueva* ruta GSI impide publicar la IRQ directamente a una vCPU, independientemente del tipo de enrutamiento de GSI. Actualizar el IRTE solo si la nueva GSI es una MSI hace que KVM deje una publicaci\u00f3n de IRTE en una vCPU. El IRTE pendiente puede provocar que las interrupciones se entreguen incorrectamente al invitado y, en el peor de los casos, puede provocar un use-after-free, por ejemplo, si se desactiva la m\u00e1quina virtual, pero no se libera la IRQ del host subyacente."}], "id": "CVE-2025-37885", "lastModified": "2026-10-15T22:18:20.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37885", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:45:46.467079Z", "version": "2.0.3"}}]}, "published": "2025-05-09T07:16:09.843", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/023816bd5fa46fab94d1e7917fe131b79ed1fb41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/116c7d35b8f72eac383b9fd371d7c1a8ffc2968b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3066ec21d1a33896125747f68638725f456308db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3481fd96d801715942b6f69fe251133128156f30"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b5de7ac74f69603ad803c524b840bffd36368fc3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: KVM: x86: Reset IRTE to host control if *new* route isn't postable", "id": "2365279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365279"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: x86: Reset IRTE to host control if *new* route isn't postable\nRestore an IRTE back to host control (remapped or posted MSI mode) if the\n*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of\nthe GSI routing type. Updating the IRTE if and only if the new GSI is an\nMSI results in KVM leaving an IRTE posting to a vCPU.\nThe dangling IRTE can result in interrupts being incorrectly delivered to\nthe guest, and in the worst case scenario can result in use-after-free,\ne.g. if the VM is torn down, but the underlying host IRQ isn't freed."], "name": "CVE-2025-37885", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37885\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37885\nhttps://lore.kernel.org/linux-cve-announce/2025050945-CVE-2025-37885-a5d9@gregkh/T"], "threat_severity": "Moderate"}

{}