CVE-2025-58147

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause...

ALPINE-CVE-2025-58147

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause...

CVE-2025-58148

Xen hypervisor vulnerability CVE-2025-58148 arises from Viridian hypercalls accepting vCPU ID masks in any input format. The flaw can cause send_ipi() to read d->vcpu[] out-of-bounds and operate on a wild vCPU pointer, enabling out-of-bounds reads/writes. Connected advisories confirm impact on...

CVE-2025-58147

CVE-2025-58147 and CVE-2025-58148 describe Xen hypervisor boundary-checking bugs in Viridian hypercalls. Affected: hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting bitmaps; any input format can cause send_ipi() to read d->vcpu[] out-of-...

CVE-2025-58148 x86: Incorrect input sanitisation in Viridian hypercalls

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause...

CVE-2025-58148

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause...

KVM: arm64: Prevent access to vCPU events before init

...

SUSE CVE-2025-40102

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

EUVD-2025-36976

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

CVE-2025-40102

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

AZL-69412 CVE-2025-40102 affecting package kernel 6.6.126.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

CVE-2025-40102 KVM: arm64: Prevent access to vCPU events before init

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

CVE-2025-40102

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from allowing access to vCPU events before vCPU initialization, which could lead to an exception injection error...

Linux Distros Unpatched Vulnerability : CVE-2025-40102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that...

UBUNTU-CVE-2025-40026

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't recheck L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instructi...

SUSE CVE-2025-58147

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause...

PT-2025-44392

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc4-00104-g10fd0285305d Description The Linux kernel KVM component contains a flaw where it erroneously allows userspace to pend vCPU events for a vCPU that has not been initialized. This can lead to KVM...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987102 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix stack-out-of-bounds memory access from ioapicwriteindirect KASAN reports the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987125)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987125 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Fix kvmarchvcpuioctl vcpuload leak vcpuput is not called if the user copy fails. This c...