In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: use arrayindexnospec with indices that come from guest
min and destid are guest-controlled indices. Using arrayindex_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.
[
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"257088386552264343001743955338385371719",
"279624530813766314956490410606540097439",
"82723035313593347035353068378047368140",
"142376133059234727967615088808953544860",
"7481305589700128346338898501608930253"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48",
"id": "CVE-2025-39823-0a0fec70"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 601.0,
"function_hash": "271508708237346016568596938996604940614"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c87bd4dd43a624109c3cc42d843138378a7f4548",
"id": "CVE-2025-39823-0e907a7d"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"151536284646819617953282235034013243226",
"202659449595887897020495346344743141725",
"24236834183257573923887140922124797406",
"59455061785417697661814071417702838536",
"315151417299123793123635720531855675722"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f57a4bd8d6cb5af05b8ac1be9098e249034639fb",
"id": "CVE-2025-39823-17c5ea03"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 601.0,
"function_hash": "271508708237346016568596938996604940614"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51e381beed5e2f50f85f49f6c90e023754efa12",
"id": "CVE-2025-39823-1f8fa840"
},
{
"signature_type": "Function",
"target": {
"function": "__pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 441.0,
"function_hash": "161461961832355608570336141280691155771"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67a05679621b7f721bdba37a5d18665d3aceb695",
"id": "CVE-2025-39823-3760d514"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113631887884461169811177517663402128433",
"193857957479729429282195104967483139669",
"2074583880238874175989322523672444954"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f",
"id": "CVE-2025-39823-3c159eb0"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"151536284646819617953282235034013243226",
"202659449595887897020495346344743141725",
"24236834183257573923887140922124797406",
"59455061785417697661814071417702838536",
"315151417299123793123635720531855675722"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c87bd4dd43a624109c3cc42d843138378a7f4548",
"id": "CVE-2025-39823-4600422a"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113631887884461169811177517663402128433",
"193857957479729429282195104967483139669",
"2074583880238874175989322523672444954"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f49161646e03d107ce81a99c6ca5da682fe5fb69",
"id": "CVE-2025-39823-461a360e"
},
{
"signature_type": "Function",
"target": {
"function": "__pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 441.0,
"function_hash": "161461961832355608570336141280691155771"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c87bd4dd43a624109c3cc42d843138378a7f4548",
"id": "CVE-2025-39823-480345a3"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"151536284646819617953282235034013243226",
"202659449595887897020495346344743141725",
"24236834183257573923887140922124797406",
"59455061785417697661814071417702838536",
"315151417299123793123635720531855675722"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f49161646e03d107ce81a99c6ca5da682fe5fb69",
"id": "CVE-2025-39823-524bb375"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113631887884461169811177517663402128433",
"193857957479729429282195104967483139669",
"2074583880238874175989322523672444954"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67a05679621b7f721bdba37a5d18665d3aceb695",
"id": "CVE-2025-39823-5af70b30"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 601.0,
"function_hash": "271508708237346016568596938996604940614"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f",
"id": "CVE-2025-39823-5c9fdde1"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 601.0,
"function_hash": "271508708237346016568596938996604940614"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f49161646e03d107ce81a99c6ca5da682fe5fb69",
"id": "CVE-2025-39823-63b1ed8a"
},
{
"signature_type": "Function",
"target": {
"function": "__pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 441.0,
"function_hash": "161461961832355608570336141280691155771"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f",
"id": "CVE-2025-39823-69d57bbc"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113631887884461169811177517663402128433",
"193857957479729429282195104967483139669",
"2074583880238874175989322523672444954"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51e381beed5e2f50f85f49f6c90e023754efa12",
"id": "CVE-2025-39823-756902e5"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"257088386552264343001743955338385371719",
"279624530813766314956490410606540097439",
"82723035313593347035353068378047368140",
"142376133059234727967615088808953544860",
"7481305589700128346338898501608930253"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31a0ad2f60cb4816e06218b63e695eb72ce74974",
"id": "CVE-2025-39823-76b16a32"
},
{
"signature_type": "Function",
"target": {
"function": "__pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 441.0,
"function_hash": "161461961832355608570336141280691155771"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31a0ad2f60cb4816e06218b63e695eb72ce74974",
"id": "CVE-2025-39823-7a0f7ed0"
},
{
"signature_type": "Function",
"target": {
"function": "__pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 441.0,
"function_hash": "161461961832355608570336141280691155771"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f49161646e03d107ce81a99c6ca5da682fe5fb69",
"id": "CVE-2025-39823-8f21c0e6"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113631887884461169811177517663402128433",
"193857957479729429282195104967483139669",
"2074583880238874175989322523672444954"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c87bd4dd43a624109c3cc42d843138378a7f4548",
"id": "CVE-2025-39823-9d056c36"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113631887884461169811177517663402128433",
"193857957479729429282195104967483139669",
"2074583880238874175989322523672444954"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f57a4bd8d6cb5af05b8ac1be9098e249034639fb",
"id": "CVE-2025-39823-9f0b1420"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"151536284646819617953282235034013243226",
"202659449595887897020495346344743141725",
"24236834183257573923887140922124797406",
"59455061785417697661814071417702838536",
"315151417299123793123635720531855675722"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51e381beed5e2f50f85f49f6c90e023754efa12",
"id": "CVE-2025-39823-9fec5dcf"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 601.0,
"function_hash": "271508708237346016568596938996604940614"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67a05679621b7f721bdba37a5d18665d3aceb695",
"id": "CVE-2025-39823-a0eeacfd"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"150297728609967866621741106865007979752",
"316034188229971838817710416054325731414",
"18740990280142095388636806432338653187",
"178305120586703830990757394995658362914"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48",
"id": "CVE-2025-39823-a26f8a8b"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"151536284646819617953282235034013243226",
"202659449595887897020495346344743141725",
"24236834183257573923887140922124797406",
"59455061785417697661814071417702838536",
"315151417299123793123635720531855675722"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67a05679621b7f721bdba37a5d18665d3aceb695",
"id": "CVE-2025-39823-a6fc0414"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 1277.0,
"function_hash": "138256484892736576181296077432969630683"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48",
"id": "CVE-2025-39823-a999a51e"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 362.0,
"function_hash": "329206838261629798500797761995527214348"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48",
"id": "CVE-2025-39823-d86546bd"
},
{
"signature_type": "Function",
"target": {
"function": "__pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 441.0,
"function_hash": "161461961832355608570336141280691155771"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f57a4bd8d6cb5af05b8ac1be9098e249034639fb",
"id": "CVE-2025-39823-e79070f6"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 362.0,
"function_hash": "329206838261629798500797761995527214348"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31a0ad2f60cb4816e06218b63e695eb72ce74974",
"id": "CVE-2025-39823-ee0ac12d"
},
{
"signature_type": "Function",
"target": {
"function": "__pv_send_ipi",
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"length": 441.0,
"function_hash": "161461961832355608570336141280691155771"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d51e381beed5e2f50f85f49f6c90e023754efa12",
"id": "CVE-2025-39823-f61b1188"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/lapic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"113631887884461169811177517663402128433",
"193857957479729429282195104967483139669",
"2074583880238874175989322523672444954"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31a0ad2f60cb4816e06218b63e695eb72ce74974",
"id": "CVE-2025-39823-f6d1a3ba"
},
{
"signature_type": "Line",
"target": {
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"151536284646819617953282235034013243226",
"202659449595887897020495346344743141725",
"24236834183257573923887140922124797406",
"59455061785417697661814071417702838536",
"315151417299123793123635720531855675722"
]
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f",
"id": "CVE-2025-39823-f7efe463"
},
{
"signature_type": "Function",
"target": {
"function": "kvm_sched_yield",
"file": "arch/x86/kvm/x86.c"
},
"digest": {
"length": 601.0,
"function_hash": "271508708237346016568596938996604940614"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f57a4bd8d6cb5af05b8ac1be9098e249034639fb",
"id": "CVE-2025-39823-ff092bf9"
}
]