CVE-2025-37996

Summary: CVE-2025-37996 affects the Linux kernel on ARM64 with KVM. The root cause was an uninitialized local memcache pointer in user_mem_abort() caused by a conditional initialization after the commit that plumbed the pKVM MMU. A code path through kvm_pgtable_stage2_map() could use the uninitia...

PT-2025-23155 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, specifically in the KVM Kernel-based Virtual Machine for arm64 architecture. The issue was caused by an uninitialized memcache...

CVE-2025-37957

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f "KVM: x86: forcibly leave nested mode on vCPU reset" addressed an issue where a triple fault occurring in nested mode could lead to...

CVE-2025-37957 KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f "KVM: x86: forcibly leave nested mode on vCPU reset" addressed an issue where a triple fault occurring in nested mode could lead to...

CVE-2025-37957

CVE-2025-37957 describes a Linux kernel KVM/VMX issue where, if a VM enters SMM via KVM_SMI and then encounters invalid instructions leading to exceptions, forcing a vCPU reset during SHUTDOWN interception can trigger a WARN in kvm_vcpu_reset due to the vCPU being in SMM. The root cause is omissi...

CVE-2025-37936

CVE-2025-37936: Linux kernel issue in perf/x86/intel/KVM where MSR_IA32_PEBS_ENABLE loaded for a guest could be masked incorrectly when deriving PEBS_ENABLE, causing guest PEBS to be enabled unintentionally and potentially crash the guest with a flood of #PFs. The fix masks the guest MSR value us...

CVE-2025-37885

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if new route isn't postable Restore an IRTE back to host control remapped or posted MSI mode if the new GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing typ...

CVE-2025-37885 KVM: x86: Reset IRTE to host control if *new* route isn't postable

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if new route isn't postable Restore an IRTE back to host control remapped or posted MSI mode if the new GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing typ...

CVE-2025-37885

CVE-2025-37885 affects the Linux kernel KVM/x86, where a dangling IRTE could be left posting to a vCPU if the new GSI route cannot be posted. The issue is fixed by restoring IRTE ownership to the host control when the new route isn’t postable, preventing use-after-free and incorrect interrupt del...

CVE-2025-37885 KVM: x86: Reset IRTE to host control if *new* route isn't postable

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if new route isn't postable Restore an IRTE back to host control remapped or posted MSI mode if the new GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing typ...

CVE-2022-49932

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Do all initialization before exposing /dev/kvm to userspace Call kvminit only after all setup is complete, as kvminit exposes /dev/kvm to userspace and thus allows userspace to create VMs and call other ioctls. E.g. KVM...

CVE-2022-49883

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format On 64 bit host, if the guest doesn't have X86FEATURELM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host,...

CVE-2022-49884

In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfntopfncache locks in dedicated helper Move the gfntopfncache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvmgfntopfncacheinit'...

CVE-2022-49882

In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfntopfncache Reject kvmgpccheck and kvmgpcrefresh if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a vali...

CVE-2022-49884 KVM: Initialize gfn_to_pfn_cache locks in dedicated helper

In the Linux kernel, the following vulnerability has been resolved: KVM: Initialize gfntopfncache locks in dedicated helper Move the gfntopfncache lock initialization to another helper and call the new helper during VM/vCPU creation. There are race conditions possible due to kvmgfntopfncacheinit'...

CVE-2022-49882 KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache

In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfntopfncache Reject kvmgpccheck and kvmgpcrefresh if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a vali...

CVE-2022-49883 KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format On 64 bit host, if the guest doesn't have X86FEATURELM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host,...

CVE-2022-49883

CVE-2022-49883 is a Linux kernel KVM x86 vulnerability related to SMM handling. The issue arises because the number of general purpose registers (GPRs) used for the SMRAM image depends on the image format. On 64‑bit hosts, if the guest lacks X86_FEATURE_LM, KVM may access 16 GPRs for a 32‑bit SMR...

CVE-2022-49882 KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache

In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfntopfncache Reject kvmgpccheck and kvmgpcrefresh if the cache is inactive. Not checking the active flag during refresh is particularly egregious, as KVM can end up with a vali...

CVE-2022-49883 KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format On 64 bit host, if the guest doesn't have X86FEATURELM, KVM will access 16 gprs to 32-bit smram image, causing out-ouf-bound ram access. On 32 bit host,...