LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21779: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID. Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC: dump_stack+0xbe/0xfd __kasan_report.cold+0x34/0x84 kasan_report+0x3a/0x50 __apic_accept_irq+0x3a/0x5c0 kvm_hv_send_ipi.isra.0+0x34e/0x820 kvm_hv_hypercall+0x8d9/0x9d0 kvm_emulate_hypercall+0x506/0x7e0 __vmx_handle_exit+0x283/0xb60 vmx_handle_exit+0x1d/0xd0 vcpu_enter_guest+0x16b0/0x24c0 vcpu_run+0xc0/0x550 kvm_arch_vcpu_ioctl_run+0x170/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscal1_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21779 is a Linux KVM x86 issue in handling Hyper-V SEND_IPI hypercalls. In a specific VM configuration, a guest could trigger a host kernel NULL-pointer dereference. The main business concern is potential denial of service on virtualization hosts, not confirmed data theft or active exploitation.

Executive priority

Treat this as a virtualization host stability issue. Patch KVM hosts during the next maintenance window, sooner for multi-tenant or untrusted guest environments. There is no provided evidence of active exploitation, but host crashes can still affect service availability.

Technical view

KVM advertised Hyper-V SEND_IPI and SEND_IPI_EX support even when the local APIC was emulated in userspace. The fix advertises and accepts those hypercalls only when KVM provides an in-kernel local APIC, avoiding a NULL dereference in __apic_accept_irq through kvm_hv_send_ipi.

Likely exposure

Exposure is most relevant to Linux systems acting as KVM x86 hypervisors, especially where Hyper-V enlightenments are exposed to guests and the local APIC is not in-kernel. Non-virtualization Linux hosts are unlikely to be exposed based on the provided sources.

Exploitation context

The source bundle does not show CISA KEV listing, public exploitation, exploit code, or confirmed attacks. The described trigger is a guest hypercall path under a specific KVM configuration, so validation should focus on virtualization hosts and kernel patch state.

Researcher notes

The fix changes capability exposure and runtime rejection for Hyper-V SEND_IPI/SEND_IPI_EX when local APIC handling is not in-kernel. The source notes checking the sending vCPU is sufficient because per-VM irqchip mode cannot change after vCPU creation.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable KVM fixes.
  • Prioritize Debian LTS systems covered by the cited Debian advisories.
  • Review hypervisor configurations exposing Hyper-V enlightenments to guests.
  • Check vendor guidance if no patched kernel is available.
  • Avoid unsupported kernel builds on KVM virtualization hosts.

Validation and detection

  • Inventory Linux hosts running KVM x86 virtualization workloads.
  • Confirm running kernel versions against vendor fixed packages or stable commits.
  • Check whether guests receive Hyper-V enlightenment features.
  • Review KVM configuration for in-kernel versus userspace local APIC behavior.
  • Monitor host logs for KVM NULL dereference or kernel oops events.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21779 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux214ff83d4473a7757fa18a64dc7efe3b0e158486, 214ff83d4473a7757fa18a64dc7efe3b0e158486, 214ff83d4473a7757fa18a64dc7efe3b0e158486, 214ff83d4473a7757fa18a64dc7efe3b0e158486, 214ff83d4473a7757fa18a64dc7efe3b0e158486, 214ff83d4473a7757fa18a64dc7efe3b0e158486, 214ff83d4473a7757fa18a64dc7efe3b0e158486unaffected
LinuxLinux4.20, 0, 5.10.236, 5.15.179, 6.1.129, 6.6.79, 6.12.16, 6.13.4, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.