In the Linux kernel, the following vulnerability has been resolved:
xen/events: Return -EEXIST for bound VIRQs
Change findvirq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUGON() from bindvirqto_irq() to propogate the error upwards.
Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON().
A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which percpu(virqto_irq) it will be in.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07ce121d93a5e5fb2440a24da3dbf408fcee978e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259169756907800438218841534770538943518",
"241797867423050042288590689052237679033",
"12589080940142131961062945625879181022",
"49739320640985262503174989402439585779",
"203669629272086329333554669935184838012",
"301322436827510012838768204518515194621",
"99473094700600219234852795836940857382",
"259259033805684037602479521990941688902",
"86602866870568717002213780472828830935",
"225730109196435020457476243228026639856",
"149794144980480457019035122338750128369",
"282985451868460061356909130663494249147",
"92998247201902816772813925490017676768",
"158221002953693103625961190932471666803",
"91590405244164133680505572418102608661",
"158650682149496585881486960206282075862",
"138547518491422826372857830010023485590",
"209227784952246564428528835846997058684",
"127585133397013260357677881737778190695",
"9951330658834039211944996068442801677",
"274583973408136845660896386328297200282"
]
},
"target": {
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40160-27a5c4b9"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259169756907800438218841534770538943518",
"241797867423050042288590689052237679033",
"12589080940142131961062945625879181022",
"49739320640985262503174989402439585779",
"203669629272086329333554669935184838012",
"301322436827510012838768204518515194621",
"99473094700600219234852795836940857382",
"259259033805684037602479521990941688902",
"86602866870568717002213780472828830935",
"225730109196435020457476243228026639856",
"149794144980480457019035122338750128369",
"282985451868460061356909130663494249147",
"92998247201902816772813925490017676768",
"158221002953693103625961190932471666803",
"91590405244164133680505572418102608661",
"158650682149496585881486960206282075862",
"138547518491422826372857830010023485590",
"209227784952246564428528835846997058684",
"127585133397013260357677881737778190695",
"9951330658834039211944996068442801677",
"274583973408136845660896386328297200282"
]
},
"target": {
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40160-2d337240"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81db055a793eca9d05f79658ff62adafb41d664",
"digest": {
"length": 1009.0,
"function_hash": "244569704822422687241451483305320411325"
},
"target": {
"function": "bind_virq_to_irq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-2f3bd18a"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa",
"digest": {
"length": 495.0,
"function_hash": "2763337646203989604226181446667260734"
},
"target": {
"function": "find_virq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-534c6554"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81db055a793eca9d05f79658ff62adafb41d664",
"digest": {
"length": 495.0,
"function_hash": "2763337646203989604226181446667260734"
},
"target": {
"function": "find_virq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-5514459e"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07ce121d93a5e5fb2440a24da3dbf408fcee978e",
"digest": {
"length": 495.0,
"function_hash": "2763337646203989604226181446667260734"
},
"target": {
"function": "find_virq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-7d3f6eb7"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81db055a793eca9d05f79658ff62adafb41d664",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259169756907800438218841534770538943518",
"241797867423050042288590689052237679033",
"12589080940142131961062945625879181022",
"49739320640985262503174989402439585779",
"203669629272086329333554669935184838012",
"301322436827510012838768204518515194621",
"99473094700600219234852795836940857382",
"259259033805684037602479521990941688902",
"86602866870568717002213780472828830935",
"225730109196435020457476243228026639856",
"149794144980480457019035122338750128369",
"282985451868460061356909130663494249147",
"92998247201902816772813925490017676768",
"158221002953693103625961190932471666803",
"91590405244164133680505572418102608661",
"158650682149496585881486960206282075862",
"138547518491422826372857830010023485590",
"209227784952246564428528835846997058684",
"127585133397013260357677881737778190695",
"9951330658834039211944996068442801677",
"274583973408136845660896386328297200282"
]
},
"target": {
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40160-940c467f"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@612ef6056855c0aacb9b25d1d853c435754483f7",
"digest": {
"length": 495.0,
"function_hash": "2763337646203989604226181446667260734"
},
"target": {
"function": "find_virq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-ae49535d"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07ce121d93a5e5fb2440a24da3dbf408fcee978e",
"digest": {
"length": 1009.0,
"function_hash": "244569704822422687241451483305320411325"
},
"target": {
"function": "bind_virq_to_irq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-c3d8563f"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa",
"digest": {
"length": 1009.0,
"function_hash": "244569704822422687241451483305320411325"
},
"target": {
"function": "bind_virq_to_irq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-c5b52eac"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@612ef6056855c0aacb9b25d1d853c435754483f7",
"digest": {
"length": 1009.0,
"function_hash": "244569704822422687241451483305320411325"
},
"target": {
"function": "bind_virq_to_irq",
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40160-d7814a0f"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@612ef6056855c0aacb9b25d1d853c435754483f7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259169756907800438218841534770538943518",
"241797867423050042288590689052237679033",
"12589080940142131961062945625879181022",
"49739320640985262503174989402439585779",
"203669629272086329333554669935184838012",
"301322436827510012838768204518515194621",
"99473094700600219234852795836940857382",
"259259033805684037602479521990941688902",
"86602866870568717002213780472828830935",
"225730109196435020457476243228026639856",
"149794144980480457019035122338750128369",
"282985451868460061356909130663494249147",
"92998247201902816772813925490017676768",
"158221002953693103625961190932471666803",
"91590405244164133680505572418102608661",
"158650682149496585881486960206282075862",
"138547518491422826372857830010023485590",
"209227784952246564428528835846997058684",
"127585133397013260357677881737778190695",
"9951330658834039211944996068442801677",
"274583973408136845660896386328297200282"
]
},
"target": {
"file": "drivers/xen/events/events_base.c"
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40160-f0b32c26"
}
]