CVE-2025-40102
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-40102
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40102.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40102
- Downstream
- Published
- 2025-10-30T09:48:07Z
- Modified
- 2025-10-30T21:32:38.381629Z
- Summary
- KVM: arm64: Prevent access to vCPU events before init
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Prevent access to vCPU events before init
Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception.
In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exceptiontargetel() during the next injection:
kernel BUG at arch/arm64/kvm/injectfault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exceptiontargetel+0x88/0x8c lr : pendserrorexception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exceptiontargetel+0x88/0x8c (P) kvminjectserroresr+0x40/0x3b4 _kvmarmvcpusetevents+0xf0/0x100 kvmarchvcpuioctl+0x180/0x9d4 kvmvcpuioctl+0x60c/0x9f4 _arm64sysioctl+0xac/0x104 invokesyscall+0x48/0x110 el0svccommon.constprop.0+0x40/0xe0 doel0svc+0x1c/0x28 el0svc+0x34/0xf0 el0t64synchandler+0xa0/0xe4 el0t64sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000)
Reject the ioctls outright as no sane VMM would call these before KVMARMVCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb7b27facc7b50a5fce0afaa3df56157136ce181aFixed64a04e6320fc5affbadc59dc7024d79f909bfe84
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb7b27facc7b50a5fce0afaa3df56157136ce181aFixed0aa1b76fe1429629215a7c79820e4b96233ac4a3