{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-23141","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-01-11T14:28:41.512Z","datePublished":"2025-05-01T12:55:31.525Z","dateUpdated":"2026-08-05T11:57:00.774Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:57:00.774Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses\n\nAcquire a lock on kvm->srcu when userspace is getting MP state to handle a\nrather extreme edge case where \"accepting\" APIC events, i.e. processing\npending INIT or SIPI, can trigger accesses to guest memory.  If the vCPU\nis in L2 with INIT *and* a TRIPLE_FAULT request pending, then getting MP\nstate will trigger a nested VM-Exit by way of ->check_nested_events(), and\nemuating the nested VM-Exit can access guest memory.\n\nThe splat was originally hit by syzkaller on a Google-internal kernel, and\nreproduced on an upstream kernel by hacking the triple_fault_event_test\nselftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a\nmemory access on VMX), and do vcpu_mp_state_get() to trigger the scenario.\n\n  =============================\n  WARNING: suspicious RCU usage\n  6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted\n  -----------------------------\n  include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage!\n\n  other info that might help us debug this:\n\n  rcu_scheduler_active = 2, debug_locks = 1\n  1 lock held by triple_fault_ev/1256:\n   #0: ffff88810df5a330 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm]\n\n  stack backtrace:\n  CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x7f/0x90\n   lockdep_rcu_suspicious+0x144/0x190\n   kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm]\n   kvm_vcpu_read_guest+0x3e/0x90 [kvm]\n   read_and_check_msr_entry+0x2e/0x180 [kvm_intel]\n   __nested_vmx_vmexit+0x550/0xde0 [kvm_intel]\n   kvm_check_nested_events+0x1b/0x30 [kvm]\n   kvm_apic_accept_events+0x33/0x100 [kvm]\n   kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm]\n   kvm_vcpu_ioctl+0x33e/0x9a0 [kvm]\n   __x64_sys_ioctl+0x8b/0xb0\n   do_syscall_64+0x6c/0x170\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   </TASK>"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached exclusively through the `KVM_GET_MP_STATE` ioctl on a vCPU file descriptor obtained from `/dev/kvm`, requiring local access to the host. No network or remote peer input reaches this path.\nAC:L - The attacker constructs every precondition deterministically from userspace (`KVM_SET_NESTED_STATE` for L2 mode, `KVM_SET_VCPU_EVENTS` to stuff a pending triple fault, `KVM_SET_LAPIC` for pending INIT) and controls both sides of the race with its own threads — one spinning on `KVM_GET_MP_STATE`, another churning memslots via `KVM_SET_USER_MEMORY_REGION`. Nested virtualization is enabled by default on both Intel and AMD.\nPR:L - Only an open file descriptor on `/dev/kvm` is needed — no capabilities are checked anywhere along the path, and the device node is routinely accessible to unprivileged users (mode 0666 or `kvm` group membership) on desktops, developer workstations, and virtualization hosts.\nUI:N - The attacking process performs the entire sequence — VM/vCPU creation, state stuffing, the ioctl, and the concurrent memslot updates — with no action by any other user.\nS:U - The trigger is a host-userspace ioctl against the host kernel, and the corruption stays within the host kernel's security authority; a guest cannot issue ioctls, so this is not a guest-to-host escape.\nC:H - Missing SRCU protection allows use-after-free reads of `struct kvm_memory_slot` fields (`base_gfn`, `npages`, `userspace_addr`, `dirty_bitmap`) and of freed rbtree nodes; a stale `userspace_addr` redirects `__copy_from_user` to arbitrary host addresses, and reallocated heap contents become observable through the guest-memory read path.\nI:H - The same path writes: `nested_vmx_store_msr()` calls `kvm_vcpu_write_guest()`, which does `__copy_to_user` to a stale address and then `set_bit_le(rel_gfn, memslot->dirty_bitmap)` with both the pointer and the bit offset taken from freed/reallocated kernel memory — a controllable kernel-heap write primitive.\nA:H - Traversing an rbtree that is being restructured concurrently, or dereferencing a freed memslot, yields wild-pointer dereferences and kernel oops; the unprotected `srcu_dereference_check()` additionally trips a lockdep RCU warning, which is fatal under `panic_on_warn`."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/x86.c"],"versions":[{"version":"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40","lessThan":"56d997b257075951a46663970cd350cd5e34c041","status":"affected","versionType":"git"},{"version":"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40","lessThan":"0357c8406dfa09430dd9858ebe813feb65524b6e","status":"affected","versionType":"git"},{"version":"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40","lessThan":"8a3df0aa1087a89f5ce55f4aba816bfcb1ecf1be","status":"affected","versionType":"git"},{"version":"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40","lessThan":"7bc5c360375d28ba5ef6298b0d53e735c81d66a1","status":"affected","versionType":"git"},{"version":"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40","lessThan":"f5cbe725b7477b4cd677be1b86b4e08f90572997","status":"affected","versionType":"git"},{"version":"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40","lessThan":"592e040572f216d916f465047c8ce4a308fcca44","status":"affected","versionType":"git"},{"version":"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40","lessThan":"ef01cac401f18647d62720cf773d7bb0541827da","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kvm/x86.c"],"versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.135","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.88","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.24","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.12","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14.3","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.1.135"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.6.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.12.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.13.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.14.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.15"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/56d997b257075951a46663970cd350cd5e34c041"},{"url":"https://git.kernel.org/stable/c/0357c8406dfa09430dd9858ebe813feb65524b6e"},{"url":"https://git.kernel.org/stable/c/8a3df0aa1087a89f5ce55f4aba816bfcb1ecf1be"},{"url":"https://git.kernel.org/stable/c/7bc5c360375d28ba5ef6298b0d53e735c81d66a1"},{"url":"https://git.kernel.org/stable/c/f5cbe725b7477b4cd677be1b86b4e08f90572997"},{"url":"https://git.kernel.org/stable/c/592e040572f216d916f465047c8ce4a308fcca44"},{"url":"https://git.kernel.org/stable/c/ef01cac401f18647d62720cf773d7bb0541827da"}],"title":"KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T19:42:27.035Z"}}]}}