Security readout for executives and security teams
Plain-English summary
A Linux KVM flaw can leave an interrupt assigned to a virtual machine after routing changes or VM teardown. Interrupts may reach the wrong guest, and the worst case is a kernel use-after-free. This creates serious confidentiality, integrity, and availability risk on affected virtualization hosts.
Executive priority
Treat as a high-priority virtualization-host update, especially where KVM hosts run workloads with different trust levels. Schedule prompt remediation after compatibility testing. Emergency action is not supported solely by the supplied evidence because active exploitation has not been reported.
Technical view
KVM x86 did not always restore an interrupt-remapping table entry to host control when a replacement GSI route could not post directly to a vCPU. The dangling IRTE can misdeliver interrupts and, if the VM is destroyed while the host IRQ remains, trigger use-after-free. CVSS 3.1 is 8.8 with local, low-privilege access.
Likely exposure
Exposure is concentrated on Linux systems using KVM x86 virtualization and relevant posted-interrupt routing. The supplied version data identifies affected Linux branches but does not provide sufficiently clear ranges for reliable fleet-wide matching. Confirm each running kernel against distribution advisories and the referenced stable fixes.
Exploitation context
The supplied record does not identify CISA KEV listing or evidence of active exploitation. Exploitation is rated local with low privileges and no user interaction. The sources establish a potentially severe failure condition, but do not establish practical exploit reliability, public weaponization, or observed attacks.
Researcher notes
Review GSI route replacement paths where the new route is not postable, independent of routing type. Focus defensive validation on IRTE ownership restoration and VM teardown while host IRQ resources persist. The source bundle does not name a CWE or demonstrate exploitation, so avoid assuming a specific attack primitive beyond the documented misdelivery and use-after-free.
Mitigation direction
- Apply vendor kernel updates incorporating the referenced Linux stable fixes.
- Reboot affected hosts into the updated kernel after normal change-control testing.
- Consult distribution advisories where exact affected and fixed package versions remain unclear.
- Prioritize shared or untrusted-workload KVM hosts because consequences may cross security boundaries.
Validation and detection
- Inventory x86 Linux hosts running KVM and record their active kernel versions.
- Compare active kernels with distribution advisories and referenced stable commits.
- Verify updated hosts booted the intended fixed kernel, not merely installed it.
- Regression-test VM interrupt routing, device assignment, shutdown, and teardown workflows.
- Monitor host kernel logs for crashes, use-after-free reports, or unexpected interrupt behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37885 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769CVE reference, Linux
- https://git.kernel.org/stable/c/116c7d35b8f72eac383b9fd371d7c1a8ffc2968bCVE reference, Linux
- https://git.kernel.org/stable/c/023816bd5fa46fab94d1e7917fe131b79ed1fb41CVE reference, Linux
- https://git.kernel.org/stable/c/3481fd96d801715942b6f69fe251133128156f30CVE reference, Linux
- https://git.kernel.org/stable/c/b5de7ac74f69603ad803c524b840bffd36368fc3CVE reference, Linux
- https://git.kernel.org/stable/c/3066ec21d1a33896125747f68638725f456308dbCVE reference, Linux
- https://git.kernel.org/stable/c/9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.