{"id":"CVE-2025-40038","revision":null,"records":[{"revision":"a03e38a6609649818877f00ed5213069","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-40038","aliases":[],"title":"KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid\n\nSkip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP\nisn't valid, e.g. because KVM is running with nrips=false. SVM must\ndecode and emulate to skip the instruction if the CPU doesn't provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory. Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last enabled at (30579): [] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [] __schedule+0x1e2/0xed0\n softirqs last enabled at (30570): [] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n \n dump_stack_lvl+0x7d/0xb0\n __might_resched+0x271/0x290\n __might_fault+0x28/0x80\n kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n x86_decode_insn+0xd1/0x1010 [kvm]\n x86_emulate_instruction+0x105/0x810 [kvm]\n __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n handle_fastpath_invd+0xc4/0x1a0 [kvm]\n vcpu_run+0x11a1/0x1db0 [kvm]\n kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x8a/0x2c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n \n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn't valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons).","state":0,"publishedAt":"2025-10-28T11:48:18.889+00:00","modifiedAt":"2026-10-15T22:02:36.482+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"arch/x86/kvm/svm/svm.c\"\n ],\n \"versions\": [\n {\n \"version\": \"b439eb8ab578557263815ba8581d02c1b730e348\",\n \"lessThan\": \"cd3efb93677c4b0cf76348882fb429165fee33fd\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b439eb8ab578557263815ba8581d02c1b730e348\",\n \"lessThan\": \"f994e9c790ce97d3cf01af4d0a1b9add0c955aee\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b439eb8ab578557263815ba8581d02c1b730e348\",\n \"lessThan\": \"da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b439eb8ab578557263815ba8581d02c1b730e348\",\n \"lessThan\": \"0910dd7c9ad45a2605c45fd2bf3d1bcac087687c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"arch/x86/kvm/svm/svm.c\"\n ],\n \"versions\": [\n {\n \"version\": \"6.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"6.5\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.113\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.53\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.17.3\",\n \"lessThanOrEqual\": \"6.17.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd","https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee","https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70","https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40038","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-40038","identifiers":["CVE-2025-40038"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T12:02:21.9910047+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T12:02:21.9910047+00:00","lastSuccessAt":"2026-11-09T12:02:22.1773794+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:22.1773831+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-bc5670b92e6417137e6d98178f734a585c0efdac3c24cdab996a156ba398735b","complete":true,"records":421397,"lastAttemptAt":"2026-11-09T12:02:16.4943065+00:00","lastSuccessAt":"2026-11-09T12:02:16.4102763+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:16.4943065+00:00","snapshotPublishedAt":"2026-11-09T11:21:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-469e0902b40147e98a6498cf72d41be8","complete":true,"records":13655,"lastAttemptAt":"2026-11-09T12:14:17.3321495+00:00","lastSuccessAt":"2026-11-09T12:14:17.327+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:14:17.327+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T12:02:21.9910047+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T12:02:21.9910047+00:00","lastSuccessAt":"2026-11-09T12:02:22.1781502+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:22.1781508+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-44231a3c29e84c64b271bb4e9b8f3678","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T12:02:23.2886601+00:00","lastSuccessAt":"2026-11-09T12:02:23.284+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:23.284+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T12:02:17.2599038+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:17.2599038+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T12:02:16.7165115+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:16.7165115+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T12:02:21.9559708+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:21.9559708+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e6e6ac3eaece246ff08884368fe1dc99d4d393571e77c126c8f4d38d66697688","complete":true,"records":231297,"lastAttemptAt":"2026-11-09T12:02:17.0901763+00:00","lastSuccessAt":"2026-11-09T10:04:27.0059369+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:17.0901763+00:00","snapshotPublishedAt":"2026-11-09T09:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}