CVE-2025-40038

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40038", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.153Z", "datePublished": "2025-10-28T11:48:18.889Z", "dateUpdated": "2026-10-15T22:02:36.482Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:11.980Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid\n\nSkip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP\nisn't valid, e.g. because KVM is running with nrips=false. SVM must\ndecode and emulate to skip the instruction if the CPU doesn't provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory. Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0\n softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0x7d/0xb0\n __might_resched+0x271/0x290\n __might_fault+0x28/0x80\n kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n x86_decode_insn+0xd1/0x1010 [kvm]\n x86_emulate_instruction+0x105/0x810 [kvm]\n __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n handle_fastpath_invd+0xc4/0x1a0 [kvm]\n vcpu_run+0x11a1/0x1db0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x8a/0x2c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n </TASK>\n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn't valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker must execute instructions on a vCPU, i.e. run code inside a KVM guest on the host (or open /dev/kvm locally and run a minimal guest); there is no network-facing path to `svm_exit_handlers_fastpath()`. Per convention for KVM guest-to-host issues this is Local.\nAC:L - On an affected host (AMD without X86_FEATURE_NRIPS, `kvm_amd.nrips=0`, or a VMCB with `next_rip==0`) a single guest `HLT` \u2014 which every guest idle loop executes \u2014 deterministically drives `__svm_skip_emulated_instruction()` into the emulator with IRQs disabled, so the attacker can trigger it at will and repeatedly.\nPR:N - No privileges in the host's security authority are needed \u2014 an ordinary untrusted tenant VM triggers this with instructions any guest OS executes on its own, with no host credential, capability, or namespace involved.\nUI:N - The guest triggers the condition entirely on its own via a normal HLT/WRMSR VM-Exit; no host administrator or other user has to do anything.\nS:C - The vulnerable code is guest-controlled input handling in KVM, but the damage lands on the host kernel (atomic-context violation, BUG splat, potential lockup), crossing the guest/host virtualization boundary into a different security authority.\nC:N - The bug is a sleeping-in-atomic-context violation with no out-of-bounds or use-after-free access; the guest gains no read primitive, and the debug splat lands only in host dmesg which the guest cannot observe.\nI:N - No memory is corrupted and no write primitive is produced \u2014 the fetch either succeeds normally or fails with -EFAULT, and the only state change is the attacker's own guest being terminated with KVM_EXIT_INTERNAL_ERROR.\nA:H - Every guest HLT produces a host `BUG: sleeping function called from invalid context` splat (log flood, and a panic under panic_on_warn), and on CONFIG_PREEMPT_COUNT=n kernels the host actually blocks in handle_mm_fault() with hard IRQs disabled, risking deadlock/hard lockup; the failure path also spuriously kills the VM."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/svm.c"], "versions": [{"version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "cd3efb93677c4b0cf76348882fb429165fee33fd", "status": "affected", "versionType": "git"}, {"version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "f994e9c790ce97d3cf01af4d0a1b9add0c955aee", "status": "affected", "versionType": "git"}, {"version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70", "status": "affected", "versionType": "git"}, {"version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "0910dd7c9ad45a2605c45fd2bf3d1bcac087687c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/svm/svm.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.113", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd"}, {"url": "https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee"}, {"url": "https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70"}, {"url": "https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c"}], "title": "KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:18.073513Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:36.482Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:18.073513Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:56:18.876Z"}}], "cna": {"title": "KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker must execute instructions on a vCPU, i.e. run code inside a KVM guest on the host (or open /dev/kvm locally and run a minimal guest); there is no network-facing path to `svm_exit_handlers_fastpath()`. Per convention for KVM guest-to-host issues this is Local.\nAC:L - On an affected host (AMD without X86_FEATURE_NRIPS, `kvm_amd.nrips=0`, or a VMCB with `next_rip==0`) a single guest `HLT` \u2014 which every guest idle loop executes \u2014 deterministically drives `__svm_skip_emulated_instruction()` into the emulator with IRQs disabled, so the attacker can trigger it at will and repeatedly.\nPR:N - No privileges in the host's security authority are needed \u2014 an ordinary untrusted tenant VM triggers this with instructions any guest OS executes on its own, with no host credential, capability, or namespace involved.\nUI:N - The guest triggers the condition entirely on its own via a normal HLT/WRMSR VM-Exit; no host administrator or other user has to do anything.\nS:C - The vulnerable code is guest-controlled input handling in KVM, but the damage lands on the host kernel (atomic-context violation, BUG splat, potential lockup), crossing the guest/host virtualization boundary into a different security authority.\nC:N - The bug is a sleeping-in-atomic-context violation with no out-of-bounds or use-after-free access; the guest gains no read primitive, and the debug splat lands only in host dmesg which the guest cannot observe.\nI:N - No memory is corrupted and no write primitive is produced \u2014 the fetch either succeeds normally or fails with -EFAULT, and the only state change is the attacker's own guest being terminated with KVM_EXIT_INTERNAL_ERROR.\nA:H - Every guest HLT produces a host `BUG: sleeping function called from invalid context` splat (log flood, and a panic under panic_on_warn), and on CONFIG_PREEMPT_COUNT=n kernels the host actually blocks in handle_mm_fault() with hard IRQs disabled, risking deadlock/hard lockup; the failure path also spuriously kills the VM."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "cd3efb93677c4b0cf76348882fb429165fee33fd", "versionType": "git"}, {"status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "f994e9c790ce97d3cf01af4d0a1b9add0c955aee", "versionType": "git"}, {"status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70", "versionType": "git"}, {"status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "0910dd7c9ad45a2605c45fd2bf3d1bcac087687c", "versionType": "git"}], "programFiles": ["arch/x86/kvm/svm/svm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"status": "unaffected", "version": "0", "lessThan": "6.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.113", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.53", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.3", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/kvm/svm/svm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd"}, {"url": "https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee"}, {"url": "https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70"}, {"url": "https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid\n\nSkip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP\nisn't valid, e.g. because KVM is running with nrips=false. SVM must\ndecode and emulate to skip the instruction if the CPU doesn't provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory. Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0\n softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0x7d/0xb0\n __might_resched+0x271/0x290\n __might_fault+0x28/0x80\n kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n x86_decode_insn+0xd1/0x1010 [kvm]\n x86_emulate_instruction+0x105/0x810 [kvm]\n __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n handle_fastpath_invd+0xc4/0x1a0 [kvm]\n vcpu_run+0x11a1/0x1db0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x8a/0x2c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n </TASK>\n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn't valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons)."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.113", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.53", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.3", "versionStartIncluding": "6.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "6.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:11.980Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40038", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:36.482Z", "dateReserved": "2025-04-16T07:20:57.153Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-28T11:48:18.889Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/svm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cd3efb93677c4b0cf76348882fb429165fee33fd", "status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "versionType": "git"}, {"lessThan": "f994e9c790ce97d3cf01af4d0a1b9add0c955aee", "status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "versionType": "git"}, {"lessThan": "da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70", "status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "versionType": "git"}, {"lessThan": "0910dd7c9ad45a2605c45fd2bf3d1bcac087687c", "status": "affected", "version": "b439eb8ab578557263815ba8581d02c1b730e348", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kvm/svm/svm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.113", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.53", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid\n\nSkip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP\nisn't valid, e.g. because KVM is running with nrips=false. SVM must\ndecode and emulate to skip the instruction if the CPU doesn't provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory. Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0\n softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n <TASK>\n dump_stack_lvl+0x7d/0xb0\n __might_resched+0x271/0x290\n __might_fault+0x28/0x80\n kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n x86_decode_insn+0xd1/0x1010 [kvm]\n x86_emulate_instruction+0x105/0x810 [kvm]\n __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n handle_fastpath_invd+0xc4/0x1a0 [kvm]\n vcpu_run+0x11a1/0x1db0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x8a/0x2c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n </TASK>\n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn't valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons)."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: SVM: Omitir la emulaci\u00f3n de ruta r\u00e1pida en VM-Exit si el siguiente RIP no es v\u00e1lido\n\nOmitir las rutas r\u00e1pidas de WRMSR y HLT en el gestor de VM-Exit de SVM si el siguiente RIP no es v\u00e1lido, p. ej., porque KVM se est\u00e1 ejecutando con nrips=false. SVM debe decodificar y emular para omitir la instrucci\u00f3n si la CPU no proporciona el siguiente RIP, y obtener los bytes de la instrucci\u00f3n para decodificar requiere leer la memoria invitada. La lectura de la memoria invitada a trav\u00e9s del emulador puede fallar, es decir, puede entrar en suspensi\u00f3n, lo cual no est\u00e1 permitido ya que los gestores de ruta r\u00e1pida se ejecutan con las IRQ deshabilitadas.\n\nBUG: funci\u00f3n en suspensi\u00f3n llamada desde un contexto no v\u00e1lido en ./include/linux/uaccess.h:106\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\npreempt_count: 1, esperado: 0\nINFO: lockdep est\u00e1 desactivado.\nmarca de tiempo de evento irq: 30580\nhardirqs habilitadas por \u00faltima vez en (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm]\nhardirqs deshabilitadas por \u00faltima vez en (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0\nsoftirqs habilitadas por \u00faltima vez en (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\nsoftirqs deshabilitadas por \u00faltima vez en (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210\nCPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE\nTainted: [U]=USER\nNombre del hardware: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 17/01/2025\nTraza de llamada:\n <TAREA>\n dump_stack_lvl+0x7d/0xb0\n __might_resched+0x271/0x290\n __might_fault+0x28/0x80\n kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n x86_decode_insn+0xd1/0x1010 [kvm]\n x86_emulate_instruction+0x105/0x810 [kvm]\n __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n handle_fastpath_invd+0xc4/0x1a0 [kvm]\n vcpu_run+0x11a1/0x1db0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x8a/0x2c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n </TAREA>\n\nTenga en cuenta que esto es esencialmente una reaplicaci\u00f3n del commit 5c30e8101e8d ('KVM: SVM: Omitir la ruta r\u00e1pida de WRMSR en VM-Exit si el siguiente RIP no es v\u00e1lido'), pero con una justificaci\u00f3n diferente (KVM ahora toma SRCU al omitir la instrucci\u00f3n por otras razones)."}], "id": "CVE-2025-40038", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40038", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:56:18.073513Z", "version": "2.0.3"}}]}, "published": "2025-10-28T12:15:37.733", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid", "id": "2406731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406731"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40038", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40038\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40038\nhttps://lore.kernel.org/linux-cve-announce/2025102811-CVE-2025-40038-6bd1@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-29T10:58:14.673857+00:00", "updated": "2025-10-29T10:58:14.673881+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}