CVE-2025-23141 (GCVE-0-2025-23141)

Vulnerability from cvelistv5 – Published: 2025-05-01 12:55 – Updated: 2026-08-05 11:57
VLAI
Title
KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Acquire a lock on kvm->srcu when userspace is getting MP state to handle a rather extreme edge case where "accepting" APIC events, i.e. processing pending INIT or SIPI, can trigger accesses to guest memory. If the vCPU is in L2 with INIT *and* a TRIPLE_FAULT request pending, then getting MP state will trigger a nested VM-Exit by way of ->check_nested_events(), and emuating the nested VM-Exit can access guest memory. The splat was originally hit by syzkaller on a Google-internal kernel, and reproduced on an upstream kernel by hacking the triple_fault_event_test selftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a memory access on VMX), and do vcpu_mp_state_get() to trigger the scenario. ============================= WARNING: suspicious RCU usage 6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted ----------------------------- include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by triple_fault_ev/1256: #0: ffff88810df5a330 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm] stack backtrace: CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x144/0x190 kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] read_and_check_msr_entry+0x2e/0x180 [kvm_intel] __nested_vmx_vmexit+0x550/0xde0 [kvm_intel] kvm_check_nested_events+0x1b/0x30 [kvm] kvm_apic_accept_events+0x33/0x100 [kvm] kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm] kvm_vcpu_ioctl+0x33e/0x9a0 [kvm] __x64_sys_ioctl+0x8b/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40 , < 56d997b257075951a46663970cd350cd5e34c041 (git)
Affected: 1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40 , < 0357c8406dfa09430dd9858ebe813feb65524b6e (git)
Affected: 1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40 , < 8a3df0aa1087a89f5ce55f4aba816bfcb1ecf1be (git)
Affected: 1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40 , < 7bc5c360375d28ba5ef6298b0d53e735c81d66a1 (git)
Affected: 1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40 , < f5cbe725b7477b4cd677be1b86b4e08f90572997 (git)
Affected: 1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40 , < 592e040572f216d916f465047c8ce4a308fcca44 (git)
Affected: 1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40 , < ef01cac401f18647d62720cf773d7bb0541827da (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.135 , ≤ 6.1.* (semver)
Unaffected: 6.6.88 , ≤ 6.6.* (semver)
Unaffected: 6.12.24 , ≤ 6.12.* (semver)
Unaffected: 6.13.12 , ≤ 6.13.* (semver)
Unaffected: 6.14.3 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:27.035Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "56d997b257075951a46663970cd350cd5e34c041",
              "status": "affected",
              "version": "1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40",
              "versionType": "git"
            },
            {
              "lessThan": "0357c8406dfa09430dd9858ebe813feb65524b6e",
              "status": "affected",
              "version": "1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40",
              "versionType": "git"
            },
            {
              "lessThan": "8a3df0aa1087a89f5ce55f4aba816bfcb1ecf1be",
              "status": "affected",
              "version": "1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40",
              "versionType": "git"
            },
            {
              "lessThan": "7bc5c360375d28ba5ef6298b0d53e735c81d66a1",
              "status": "affected",
              "version": "1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40",
              "versionType": "git"
            },
            {
              "lessThan": "f5cbe725b7477b4cd677be1b86b4e08f90572997",
              "status": "affected",
              "version": "1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40",
              "versionType": "git"
            },
            {
              "lessThan": "592e040572f216d916f465047c8ce4a308fcca44",
              "status": "affected",
              "version": "1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40",
              "versionType": "git"
            },
            {
              "lessThan": "ef01cac401f18647d62720cf773d7bb0541827da",
              "status": "affected",
              "version": "1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.135",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.24",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses\n\nAcquire a lock on kvm-\u003esrcu when userspace is getting MP state to handle a\nrather extreme edge case where \"accepting\" APIC events, i.e. processing\npending INIT or SIPI, can trigger accesses to guest memory.  If the vCPU\nis in L2 with INIT *and* a TRIPLE_FAULT request pending, then getting MP\nstate will trigger a nested VM-Exit by way of -\u003echeck_nested_events(), and\nemuating the nested VM-Exit can access guest memory.\n\nThe splat was originally hit by syzkaller on a Google-internal kernel, and\nreproduced on an upstream kernel by hacking the triple_fault_event_test\nselftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a\nmemory access on VMX), and do vcpu_mp_state_get() to trigger the scenario.\n\n  =============================\n  WARNING: suspicious RCU usage\n  6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted\n  -----------------------------\n  include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage!\n\n  other info that might help us debug this:\n\n  rcu_scheduler_active = 2, debug_locks = 1\n  1 lock held by triple_fault_ev/1256:\n   #0: ffff88810df5a330 (\u0026vcpu-\u003emutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm]\n\n  stack backtrace:\n  CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x7f/0x90\n   lockdep_rcu_suspicious+0x144/0x190\n   kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm]\n   kvm_vcpu_read_guest+0x3e/0x90 [kvm]\n   read_and_check_msr_entry+0x2e/0x180 [kvm_intel]\n   __nested_vmx_vmexit+0x550/0xde0 [kvm_intel]\n   kvm_check_nested_events+0x1b/0x30 [kvm]\n   kvm_apic_accept_events+0x33/0x100 [kvm]\n   kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm]\n   kvm_vcpu_ioctl+0x33e/0x9a0 [kvm]\n   __x64_sys_ioctl+0x8b/0xb0\n   do_syscall_64+0x6c/0x170\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through the `KVM_GET_MP_STATE` ioctl on a vCPU file descriptor obtained from `/dev/kvm`, requiring local access to the host. No network or remote peer input reaches this path.\nAC:L - The attacker constructs every precondition deterministically from userspace (`KVM_SET_NESTED_STATE` for L2 mode, `KVM_SET_VCPU_EVENTS` to stuff a pending triple fault, `KVM_SET_LAPIC` for pending INIT) and controls both sides of the race with its own threads \u2014 one spinning on `KVM_GET_MP_STATE`, another churning memslots via `KVM_SET_USER_MEMORY_REGION`. Nested virtualization is enabled by default on both Intel and AMD.\nPR:L - Only an open file descriptor on `/dev/kvm` is needed \u2014 no capabilities are checked anywhere along the path, and the device node is routinely accessible to unprivileged users (mode 0666 or `kvm` group membership) on desktops, developer workstations, and virtualization hosts.\nUI:N - The attacking process performs the entire sequence \u2014 VM/vCPU creation, state stuffing, the ioctl, and the concurrent memslot updates \u2014 with no action by any other user.\nS:U - The trigger is a host-userspace ioctl against the host kernel, and the corruption stays within the host kernel\u0027s security authority; a guest cannot issue ioctls, so this is not a guest-to-host escape.\nC:H - Missing SRCU protection allows use-after-free reads of `struct kvm_memory_slot` fields (`base_gfn`, `npages`, `userspace_addr`, `dirty_bitmap`) and of freed rbtree nodes; a stale `userspace_addr` redirects `__copy_from_user` to arbitrary host addresses, and reallocated heap contents become observable through the guest-memory read path.\nI:H - The same path writes: `nested_vmx_store_msr()` calls `kvm_vcpu_write_guest()`, which does `__copy_to_user` to a stale address and then `set_bit_le(rel_gfn, memslot-\u003edirty_bitmap)` with both the pointer and the bit offset taken from freed/reallocated kernel memory \u2014 a controllable kernel-heap write primitive.\nA:H - Traversing an rbtree that is being restructured concurrently, or dereferencing a freed memslot, yields wild-pointer dereferences and kernel oops; the unprotected `srcu_dereference_check()` additionally trips a lockdep RCU warning, which is fatal under `panic_on_warn`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:00.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/56d997b257075951a46663970cd350cd5e34c041"
        },
        {
          "url": "https://git.kernel.org/stable/c/0357c8406dfa09430dd9858ebe813feb65524b6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a3df0aa1087a89f5ce55f4aba816bfcb1ecf1be"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bc5c360375d28ba5ef6298b0d53e735c81d66a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5cbe725b7477b4cd677be1b86b4e08f90572997"
        },
        {
          "url": "https://git.kernel.org/stable/c/592e040572f216d916f465047c8ce4a308fcca44"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef01cac401f18647d62720cf773d7bb0541827da"
        }
      ],
      "title": "KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-23141",
    "datePublished": "2025-05-01T12:55:31.525Z",
    "dateReserved": "2025-01-11T14:28:41.512Z",
    "dateUpdated": "2026-08-05T11:57:00.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-23141",
      "date": "2026-08-07",
      "epss": "0.002",
      "percentile": "0.09963"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-23141\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T13:15:49.910\",\"lastModified\":\"2026-07-30T06:22:16.450\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses\\n\\nAcquire a lock on kvm-\u003esrcu when userspace is getting MP state to handle a\\nrather extreme edge case where \\\"accepting\\\" APIC events, i.e. processing\\npending INIT or SIPI, can trigger accesses to guest memory.  If the vCPU\\nis in L2 with INIT *and* a TRIPLE_FAULT request pending, then getting MP\\nstate will trigger a nested VM-Exit by way of -\u003echeck_nested_events(), and\\nemuating the nested VM-Exit can access guest memory.\\n\\nThe splat was originally hit by syzkaller on a Google-internal kernel, and\\nreproduced on an upstream kernel by hacking the triple_fault_event_test\\nselftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a\\nmemory access on VMX), and do vcpu_mp_state_get() to trigger the scenario.\\n\\n  =============================\\n  WARNING: suspicious RCU usage\\n  6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted\\n  -----------------------------\\n  include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage!\\n\\n  other info that might help us debug this:\\n\\n  rcu_scheduler_active = 2, debug_locks = 1\\n  1 lock held by triple_fault_ev/1256:\\n   #0: ffff88810df5a330 (\u0026vcpu-\u003emutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm]\\n\\n  stack backtrace:\\n  CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x7f/0x90\\n   lockdep_rcu_suspicious+0x144/0x190\\n   kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm]\\n   kvm_vcpu_read_guest+0x3e/0x90 [kvm]\\n   read_and_check_msr_entry+0x2e/0x180 [kvm_intel]\\n   __nested_vmx_vmexit+0x550/0xde0 [kvm_intel]\\n   kvm_check_nested_events+0x1b/0x30 [kvm]\\n   kvm_apic_accept_events+0x33/0x100 [kvm]\\n   kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm]\\n   kvm_vcpu_ioctl+0x33e/0x9a0 [kvm]\\n   __x64_sys_ioctl+0x8b/0xb0\\n   do_syscall_64+0x6c/0x170\\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n   \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86: Adquisici\u00f3n de SRCU en KVM_GET_MP_STATE para proteger los accesos a la memoria del invitado. Adquisici\u00f3n de un bloqueo en kvm-\u0026gt;srcu cuando el espacio de usuario obtiene el estado MP para gestionar un caso extremo en el que la \\\"aceptaci\u00f3n\\\" de eventos APIC, es decir, el procesamiento de INIT o SIPI pendientes, puede desencadenar accesos a la memoria del invitado. Si la vCPU est\u00e1 en L2 con INIT *y* una solicitud TRIPLE_FAULT pendiente, obtener el estado MP activar\u00e1 una salida de m\u00e1quina virtual anidada mediante -\u0026gt;check_nested_events(), y la emulaci\u00f3n de la salida de m\u00e1quina virtual anidada puede acceder a la memoria del invitado. El splat fue alcanzado originalmente por syzkaller en un kernel interno de Google, y reproducido en un kernel ascendente hackeando la autoprueba triple_fault_event_test para rellenar un INIT pendiente, almacenar un MSR en VM-Exit (para generar un acceso a memoria en VMX), y hacer vcpu_mp_state_get() para activar el escenario. ============================== ADVERTENCIA: uso sospechoso de RCU 6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 No contaminado ----------------------------- include/linux/kvm_host.h:1058 \u00a1uso sospechoso de rcu_dereference_check()! Otra informaci\u00f3n que podr\u00eda ayudarnos a depurar esto: rcu_scheduler_active = 2, debug_locks = 1 1 bloqueo mantenido por triple_fault_ev/1256: #0: ffff88810df5a330 (\u0026amp;vcpu-\u0026gt;mutex){+.+.}-{4:4}, en: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm] seguimiento de pila: CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev No contaminado 6.14.0-rc3-b112d356288b-vmx #3 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Seguimiento de llamadas:   dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x144/0x190 kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] read_and_check_msr_entry+0x2e/0x180 [kvm_intel] __nested_vmx_vmexit+0x550/0xde0 [kvm_intel] kvm_check_nested_events+0x1b/0x30 [kvm] kvm_apic_accept_events+0x33/0x100 [kvm] kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm] kvm_vcpu_ioctl+0x33e/0x9a0 [kvm] __x64_sys_ioctl+0x8b/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53  \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/x86.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40\",\"lessThan\":\"56d997b257075951a46663970cd350cd5e34c041\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40\",\"lessThan\":\"0357c8406dfa09430dd9858ebe813feb65524b6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40\",\"lessThan\":\"8a3df0aa1087a89f5ce55f4aba816bfcb1ecf1be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40\",\"lessThan\":\"7bc5c360375d28ba5ef6298b0d53e735c81d66a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40\",\"lessThan\":\"f5cbe725b7477b4cd677be1b86b4e08f90572997\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40\",\"lessThan\":\"592e040572f216d916f465047c8ce4a308fcca44\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1c96dcceaeb3a99aaf0d548eef2223e0b02a7e40\",\"lessThan\":\"ef01cac401f18647d62720cf773d7bb0541827da\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/x86.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.135\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.88\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.24\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.12\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.3\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.135\",\"matchCriteriaId\":\"29C64220-D258-41B3-A931-B8C3456115E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.88\",\"matchCriteriaId\":\"6E5947E5-45E3-462A-829B-382B3B1C61BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.24\",\"matchCriteriaId\":\"1D35A8A8-F3EC-45E6-AD37-1F154B27529D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.12\",\"matchCriteriaId\":\"4A475784-BF3B-4514-81EE-49C8522FB24A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.3\",\"matchCriteriaId\":\"483E2E15-2135-4EC6-AB64-16282C5EF704\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0357c8406dfa09430dd9858ebe813feb65524b6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/56d997b257075951a46663970cd350cd5e34c041\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/592e040572f216d916f465047c8ce4a308fcca44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bc5c360375d28ba5ef6298b0d53e735c81d66a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a3df0aa1087a89f5ce55f4aba816bfcb1ecf1be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef01cac401f18647d62720cf773d7bb0541827da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f5cbe725b7477b4cd677be1b86b4e08f90572997\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:36:25+00:00",
      "cve": "CVE-2025-23141",
      "id": "CVE-2025-23141",
      "initial_release_date": "2025-05-01T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-23141.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.