PT-2025-44392 · Linux+4 · Linux Kernel+4
Published
2025-10-13
·
Updated
2026-05-26
·
CVE-2025-40102
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.17.0-rc4-00104-g10fd0285305d
Description
The Linux kernel KVM component contains a flaw where it erroneously allows userspace to pend vCPU events for a vCPU that has not been initialized. This can lead to KVM interpreting uninitialized garbage for routing or injecting exceptions, potentially causing a kernel BUG. Specifically, the issue arises when the injection code and the hypervisor disagree on the vCPU's 32-bit EL1 status, leading to an illegal mode for AArch64 and triggering a bug in the
exception target el() function. The issue is triggered by attempting to access vCPU events before the vCPU has been fully initialized.Recommendations
Update the Linux kernel to version 6.17.0-rc4-00104-g10fd0285305d or a later version that includes the fix.
Exploit
Fix
Use of Uninitialized Resource
Access of Uninitialized Pointer
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu