PT-2025-44392 · Linux+4 · Linux Kernel+4

Published

2025-10-13

·

Updated

2026-05-26

·

CVE-2025-40102

CVSS v2.0

4.6

Medium

VectorAV:L/AC:L/Au:S/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc4-00104-g10fd0285305d
Description The Linux kernel KVM component contains a flaw where it erroneously allows userspace to pend vCPU events for a vCPU that has not been initialized. This can lead to KVM interpreting uninitialized garbage for routing or injecting exceptions, potentially causing a kernel BUG. Specifically, the issue arises when the injection code and the hypervisor disagree on the vCPU's 32-bit EL1 status, leading to an illegal mode for AArch64 and triggering a bug in the exception target el() function. The issue is triggered by attempting to access vCPU events before the vCPU has been fully initialized.
Recommendations Update the Linux kernel to version 6.17.0-rc4-00104-g10fd0285305d or a later version that includes the fix.

Exploit

Fix

Use of Uninitialized Resource

Access of Uninitialized Pointer

Weakness Enumeration

Related Identifiers

AZL-69412
BDU:2026-03983
CVE-2025-40102
ECHO-B072-0D64-AE7C
OESA-2025-2633
OESA-2025-2634
OESA-2025-2635
OPENSUSE-SU-2025:15702-1
OPENSUSE-SU-2025:20172-1
OPENSUSE-SU-2026:10301-1
SUSE-SU-2025:4111-1
SUSE-SU-2025:4139-1
SUSE-SU-2026:0278-1
SUSE-SU-2026:0281-1
SUSE-SU-2026:0293-1
SUSE-SU-2026:0315-1
SUSE-SU-2026:20012-1
SUSE-SU-2026:20015-1
SUSE-SU-2026:20021-1
SUSE-SU-2026:20477-1
SUSE-SU-2026:20498-1
SUSE-SU-2026:20845-1
SUSE-SU-2026:20876-1
USN-8029-1
USN-8029-2
USN-8029-3
USN-8030-1
USN-8048-1

Affected Products

Debian
Linuxmint
Linux Kernel
Suse
Ubuntu