{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40038", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.153Z", "datePublished": "2025-10-28T11:48:18.889Z", "dateUpdated": "2026-08-05T12:07:11.980Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:11.980Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid\n\nSkip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP\nisn't valid, e.g. because KVM is running with nrips=false. SVM must\ndecode and emulate to skip the instruction if the CPU doesn't provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory. Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last enabled at (30579): [] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [] __schedule+0x1e2/0xed0\n softirqs last enabled at (30570): [] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n \n dump_stack_lvl+0x7d/0xb0\n __might_resched+0x271/0x290\n __might_fault+0x28/0x80\n kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n x86_decode_insn+0xd1/0x1010 [kvm]\n x86_emulate_instruction+0x105/0x810 [kvm]\n __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n handle_fastpath_invd+0xc4/0x1a0 [kvm]\n vcpu_run+0x11a1/0x1db0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x8a/0x2c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n \n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn't valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attacker must execute instructions on a vCPU, i.e. run code inside a KVM guest on the host (or open /dev/kvm locally and run a minimal guest); there is no network-facing path to `svm_exit_handlers_fastpath()`. Per convention for KVM guest-to-host issues this is Local.\nAC:L - On an affected host (AMD without X86_FEATURE_NRIPS, `kvm_amd.nrips=0`, or a VMCB with `next_rip==0`) a single guest `HLT` — which every guest idle loop executes — deterministically drives `__svm_skip_emulated_instruction()` into the emulator with IRQs disabled, so the attacker can trigger it at will and repeatedly.\nPR:N - No privileges in the host's security authority are needed — an ordinary untrusted tenant VM triggers this with instructions any guest OS executes on its own, with no host credential, capability, or namespace involved.\nUI:N - The guest triggers the condition entirely on its own via a normal HLT/WRMSR VM-Exit; no host administrator or other user has to do anything.\nS:C - The vulnerable code is guest-controlled input handling in KVM, but the damage lands on the host kernel (atomic-context violation, BUG splat, potential lockup), crossing the guest/host virtualization boundary into a different security authority.\nC:N - The bug is a sleeping-in-atomic-context violation with no out-of-bounds or use-after-free access; the guest gains no read primitive, and the debug splat lands only in host dmesg which the guest cannot observe.\nI:N - No memory is corrupted and no write primitive is produced — the fetch either succeeds normally or fails with -EFAULT, and the only state change is the attacker's own guest being terminated with KVM_EXIT_INTERNAL_ERROR.\nA:H - Every guest HLT produces a host `BUG: sleeping function called from invalid context` splat (log flood, and a panic under panic_on_warn), and on CONFIG_PREEMPT_COUNT=n kernels the host actually blocks in handle_mm_fault() with hard IRQs disabled, risking deadlock/hard lockup; the failure path also spuriously kills the VM." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/svm/svm.c" ], "versions": [ { "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "cd3efb93677c4b0cf76348882fb429165fee33fd", "status": "affected", "versionType": "git" }, { "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "f994e9c790ce97d3cf01af4d0a1b9add0c955aee", "status": "affected", "versionType": "git" }, { "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70", "status": "affected", "versionType": "git" }, { "version": "b439eb8ab578557263815ba8581d02c1b730e348", "lessThan": "0910dd7c9ad45a2605c45fd2bf3d1bcac087687c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/svm/svm.c" ], "versions": [ { "version": "6.5", "status": "affected" }, { "version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.113", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.53", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.3", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.17.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd" }, { "url": "https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee" }, { "url": "https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70" }, { "url": "https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c" } ], "title": "KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid", "x_generator": { "engine": "bippy-1.2.0" } } } }