CVE-2025-40136

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40136", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.171Z", "datePublished": "2025-11-12T10:23:23.330Z", "dateUpdated": "2026-10-30T12:22:51.433Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:22:51.433Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/hisilicon/qm.c"], "versions": [{"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "lessThan": "e0a82361cef20380b1c0f342c7e92f8ddabeefc2", "status": "affected", "versionType": "git"}, {"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "lessThan": "5f75857ed634d04266301d7a4f695a7deeb9bfdc", "status": "affected", "versionType": "git"}, {"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "lessThan": "24315474ca913c0693939ab74b389ee04c7d3020", "status": "affected", "versionType": "git"}, {"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "lessThan": "854da2b0df1654d63963d587b12fec6068d89643", "status": "affected", "versionType": "git"}, {"version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "lessThan": "9228facb308157ac0bdd264b873187896f7a9c7a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/crypto/hisilicon/qm.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e0a82361cef20380b1c0f342c7e92f8ddabeefc2"}, {"url": "https://git.kernel.org/stable/c/5f75857ed634d04266301d7a4f695a7deeb9bfdc"}, {"url": "https://git.kernel.org/stable/c/24315474ca913c0693939ab74b389ee04c7d3020"}, {"url": "https://git.kernel.org/stable/c/854da2b0df1654d63963d587b12fec6068d89643"}, {"url": "https://git.kernel.org/stable/c/9228facb308157ac0bdd264b873187896f7a9c7a"}], "title": "crypto: hisilicon/qm - request reserved interrupt for virtual function", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/crypto/hisilicon/qm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e0a82361cef20380b1c0f342c7e92f8ddabeefc2", "status": "affected", "version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "versionType": "git"}, {"lessThan": "5f75857ed634d04266301d7a4f695a7deeb9bfdc", "status": "affected", "version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "versionType": "git"}, {"lessThan": "24315474ca913c0693939ab74b389ee04c7d3020", "status": "affected", "version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "versionType": "git"}, {"lessThan": "854da2b0df1654d63963d587b12fec6068d89643", "status": "affected", "version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "versionType": "git"}, {"lessThan": "9228facb308157ac0bdd264b873187896f7a9c7a", "status": "affected", "version": "3536cc55cadaf2a03241915f9cfdaf6cd073e4fe", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/crypto/hisilicon/qm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncripto: hisilicon/qm - solicitar interrupci\u00f3n reservada para funci\u00f3n virtual\n\nEl vector de interrupci\u00f3n 3 del dispositivo es una interrupci\u00f3n de error para la funci\u00f3n f\u00edsica y una interrupci\u00f3n reservada para la funci\u00f3n virtual. Sin embargo, el controlador no ha registrado la interrupci\u00f3n reservada para la funci\u00f3n virtual. Al asignar interrupciones, el n\u00famero de interrupciones se asigna bas\u00e1ndose en potencias de dos, lo que incluye esta interrupci\u00f3n. Cuando el sistema habilita GICv4 y el passthrough de funci\u00f3n virtual a la m\u00e1quina virtual, liberar la interrupci\u00f3n en el controlador activa una advertencia.\n\nEl informe de ADVERTENCIA es:\nADVERTENCIA: CPU: 62 PID: 14889 en arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nPor lo tanto, registrar una interrupci\u00f3n reservada para VF y establecer la bandera IRQF_NO_AUTOEN para evitar esa advertencia."}], "id": "CVE-2025-40136", "lastModified": "2026-10-30T13:18:13.700", "metrics": {}, "published": "2025-11-12T11:15:43.327", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/24315474ca913c0693939ab74b389ee04c7d3020"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f75857ed634d04266301d7a4f695a7deeb9bfdc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/854da2b0df1654d63963d587b12fec6068d89643"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9228facb308157ac0bdd264b873187896f7a9c7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0a82361cef20380b1c0f342c7e92f8ddabeefc2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: crypto: hisilicon/qm - request reserved interrupt for virtual function", "id": "2414486", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414486"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning."], "name": "CVE-2025-40136", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40136\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40136\nhttps://lore.kernel.org/linux-cve-announce/2025111255-CVE-2025-40136-9c55@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-12T22:12:45.115116+00:00", "updated": "2025-11-12T22:12:45.115149+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}