PT-2025-49011 · Kvm · Kvm

Published 2025-07-23 · Updated 2025-12-08 · CVE-2025-48610

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions KVM (Kernel-based Virtual Machine) (affected versions not specified)

Description A logic error in the pkvm guest relinquish to host function within mem protect.c may allow for the disclosure of configuration data. This could result in local information disclosure without requiring additional privileges or user interaction. The issue is related to incorrect calculations within the virtualization technology.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-682

Related Identifiers

BDU:2025-15121

CVE-2025-48610

Affected Products

Kvm

References · 7

• https://android.googlesource.com/kernel/common/+/cac44a0bcfc58c85082b13220b4adcac43ccf369 · Patch
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48610 · Security Note
• https://bdu.fstec.ru/vul/2025-15121 · Security Note
• https://android.googlesource.com/kernel/common/+/19fbea31785113700731f4b458d7e20d05777729 · Patch
• https://source.android.com/docs/security/bulletin/2025-12-01 · Note
• https://twitter.com/CVEnew/status/1998079577025831210 · Twitter Post