PT-2025-37194 · Linux+9 · Linux Kernel+9
Published
2025-08-14
·
Updated
2026-05-26
·
CVE-2025-40300
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux Kernel (affected versions not specified)
Description
VMScape is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). The vulnerability allows a malicious virtual machine to extract cryptographic keys from a non-modified QEMU process running on modern AMD or Intel processors. It bypasses existing Spectre mitigations and threatens confidential data leakage by exploiting speculative execution. The attack targets QEMU, a user-mode hypervisor component, utilizing a FLUSH+RELOAD cache timing channel. It leverages Spectre-BTI (Branch Target Injection) to mislead indirect branch predictions in QEMU, causing speculative execution of a data-leaking gadget. The vulnerability impacts all AMD Zen processors (Zen 1 through Zen 5) and Intel Coffee Lake processors. Newer processors, Raptor Cove and Gracemont, are not affected. The attack can potentially lead to data leakage between VMs of different clients, hypervisor compromise from a guest VM, and theft of cryptographic keys, violating isolation in multi-tenant environments.
Recommendations
Update the Linux kernel to a version that includes the conditional IBPB mitigation, which flushes the branch predictor unit (BPU) when switching from guest to host.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Linux Kernel
Qemu
Red Hat
Rocky Linux
Suse
Ubuntu