LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and getting the instruction bytes to decode requires reading guest memory. Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fastpath handlers run with IRQs disabled. BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 30580 hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm] hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0 softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE Tainted: [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025 Call Trace: <TASK> dump_stack_lvl+0x7d/0xb0 __might_resched+0x271/0x290 __might_fault+0x28/0x80 kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm] kvm_fetch_guest_virt+0x92/0xc0 [kvm] __do_insn_fetch_bytes+0xf3/0x1e0 [kvm] x86_decode_insn+0xd1/0x1010 [kvm] x86_emulate_instruction+0x105/0x810 [kvm] __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd] handle_fastpath_invd+0xc4/0x1a0 [kvm] vcpu_run+0x11a1/0x1db0 [kvm] kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm] kvm_vcpu_ioctl+0x578/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x8a/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f479d57a94b </TASK> Note, this is essentially a reapply of commit 5c30e8101e8d ("KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"), but with different justification (KVM now grabs SRCU when skipping the instruction for other reasons).

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux KVM virtualization on AMD SVM systems can make the host kernel perform a potentially sleeping guest-memory read while interrupts are disabled. This unsafe execution context may disrupt the host and its virtual machines. The supplied CVSS score is 7.1, with availability impact but no stated confidentiality or integrity impact.

Executive priority

Prioritize validation and patch planning for shared, externally accessible, or high-criticality AMD KVM infrastructure. Availability consequences could affect multiple workloads on a host. Accelerate remediation where untrusted tenants can execute virtual machines, while avoiding claims of active exploitation because none are supported by the supplied sources.

Technical view

When next RIP is unavailable, including configurations using nrips=false, KVM's SVM VM-Exit handler incorrectly uses WRMSR or HLT fastpaths. Skipping the guest instruction then requires decoding and reading guest memory, which can fault and sleep despite the handler running with interrupts disabled. The resolution bypasses these fastpaths when next RIP is invalid.

Likely exposure

Likely exposure is limited to Linux virtualization hosts using KVM's AMD SVM implementation and an affected kernel. Hosts not using AMD SVM are not identified as affected by the supplied evidence. The version data lists 6.5, 6.6.113, 6.12.53, 6.17.3, and 6.18, but does not clearly express complete affected and fixed ranges.

Exploitation context

The supplied CVSS vector indicates local attack proximity, low complexity, no privileges, no user interaction, changed scope, and high availability impact. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The exact reliability and practical impact of deliberate triggering remain unconfirmed.

Researcher notes

The reported fault path reaches instruction decoding through __svm_skip_emulated_instruction and reads guest memory while IRQs are disabled. The fix re-applies the principle of an earlier WRMSR fastpath change with updated justification. The bundle lacks a CWE, proof of concept, exploitation evidence, and unambiguous version-range semantics; distribution backport analysis is therefore necessary.

Mitigation direction

  • Check Linux distribution advisories for an updated kernel addressing CVE-2025-40038.
  • Prioritize AMD KVM hosts running kernels within vendor-confirmed affected ranges.
  • Apply a vendor-supported kernel containing the applicable referenced stable fix.
  • Use vendor guidance for interim controls if immediate kernel replacement is unavailable.

Validation and detection

  • Inventory Linux hosts using KVM with AMD SVM and record their kernel builds.
  • Compare each build against its distribution's CVE advisory and fixed-package status.
  • Confirm the installed kernel includes the applicable referenced stable commit or vendor backport.
  • Review kernel logs for invalid-context sleeping warnings involving KVM, SVM, or QEMU.
  • After updating, reboot as required and verify every host runs the intended kernel.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40038 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H2.54Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2025-40038Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb439eb8ab578557263815ba8581d02c1b730e348, b439eb8ab578557263815ba8581d02c1b730e348, b439eb8ab578557263815ba8581d02c1b730e348, b439eb8ab578557263815ba8581d02c1b730e348unaffected
LinuxLinux6.5, 0, 6.6.113, 6.12.53, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.