CVE-2025-40048 (GCVE-0-2025-40048)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-10-15 22:02
VLAI
Title
uio_hv_generic: Let userspace take care of interrupt mask
Summary
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the user space. If the mask bit gets changed by the driver, concurrently with user mode operating on the ring, the mask bit may be set when it is supposed to be clear, and the user-mode driver will miss an interrupt which will cause a hang. For eg- when the driver sets inbound ring buffer interrupt mask to 1, the host does not interrupt the guest on the UIO VMBus channel. However, setting the mask does not prevent the host from putting a message in the inbound ring buffer. So let’s assume that happens, the host puts a message into the ring buffer but does not interrupt. Subsequently, the user space code in the guest sets the inbound ring buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”. User space code then calls pread() to wait for an interrupt. Then one of two things happens: * The host never sends another message. So the pread() waits forever. * The host does send another message. But because there’s already a message in the ring buffer, it doesn’t generate an interrupt. This is the correct behavior, because the host should only send an interrupt when the inbound ring buffer transitions from empty to not-empty. Adding an additional message to a ring buffer that is not empty is not supposed to generate an interrupt on the guest. Since the guest is waiting in pread() and not removing messages from the ring buffer, the pread() waits forever. This could be easily reproduced in hv_fcopy_uio_daemon if we delay setting interrupt mask to 0. Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1, there’s a race condition. Once user space empties the inbound ring buffer, but before user space sets interrupt_mask to 0, the host could put another message in the ring buffer but it wouldn’t interrupt. Then the next pread() would hang. Fix these by removing all instances where interrupt_mask is changed, while keeping the one in set_event() unchanged to enable userspace control the interrupt mask by writing 0/1 to /dev/uioX.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:56 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < 540aac117eaea5723cef5e4cbf3035c4ac654d92 (git)
Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < 65d40acd911c7011745cbbd2aaac34eb5266d11e (git)
Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < a44f61f878f32071d6378e8dd7c2d47f9490c8f7 (git)
Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < 01ce972e6f9974a7c76943bcb7e93746917db83a (git)
Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < 2af39ab5e6dc46b835a52e80a22d0cad430985e3 (git)
Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < 37bd91f22794dc05436130d6983302cb90ecfe7e (git)
Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < e29587c07537929684faa365027f4b0d87521e1b (git)
Affected: 95096f2fbd10186d3e78a328b327afc71428f65f , < b15b7d2a1b09ef5428a8db260251897405a19496 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.10
Unaffected: 0 , < 4.10 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.112 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40048",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:56:26.830461Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:36.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio_hv_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "540aac117eaea5723cef5e4cbf3035c4ac654d92",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            },
            {
              "lessThan": "65d40acd911c7011745cbbd2aaac34eb5266d11e",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            },
            {
              "lessThan": "a44f61f878f32071d6378e8dd7c2d47f9490c8f7",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            },
            {
              "lessThan": "01ce972e6f9974a7c76943bcb7e93746917db83a",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            },
            {
              "lessThan": "2af39ab5e6dc46b835a52e80a22d0cad430985e3",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            },
            {
              "lessThan": "37bd91f22794dc05436130d6983302cb90ecfe7e",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            },
            {
              "lessThan": "e29587c07537929684faa365027f4b0d87521e1b",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            },
            {
              "lessThan": "b15b7d2a1b09ef5428a8db260251897405a19496",
              "status": "affected",
              "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio_hv_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio_hv_generic: Let userspace take care of interrupt mask\n\nRemove the logic to set interrupt mask by default in uio_hv_generic\ndriver as the interrupt mask value is supposed to be controlled\ncompletely by the user space. If the mask bit gets changed\nby the driver, concurrently with user mode operating on the ring,\nthe mask bit may be set when it is supposed to be clear, and the\nuser-mode driver will miss an interrupt which will cause a hang.\n\nFor eg- when the driver sets inbound ring buffer interrupt mask to 1,\nthe host does not interrupt the guest on the UIO VMBus channel.\nHowever, setting the mask does not prevent the host from putting a\nmessage in the inbound ring buffer.\u00a0So let\u2019s assume that happens,\nthe host puts a message into the ring buffer but does not interrupt.\n\nSubsequently, the user space code in the guest sets the inbound ring\nbuffer interrupt mask to 0, saying \u201cHey, I\u2019m ready for interrupts\u201d.\nUser space code then calls pread() to wait for an interrupt.\nThen one of two things happens:\n\n* The host never sends another message. So the pread() waits forever.\n* The host does send another message. But because there\u2019s already a\n  message in the ring buffer, it doesn\u2019t generate an interrupt.\n  This is the correct behavior, because the host should only send an\n  interrupt when the inbound ring buffer transitions from empty to\n  not-empty. Adding an additional message to a ring buffer that is not\n  empty is not supposed to generate an interrupt on the guest.\n  Since the guest is waiting in pread() and not removing messages from\n  the ring buffer, the pread() waits forever.\n\nThis could be easily reproduced in hv_fcopy_uio_daemon if we delay\nsetting interrupt mask to 0.\n\nSimilarly if hv_uio_channel_cb() sets the interrupt_mask to 1,\nthere\u2019s a race condition. Once user space empties the inbound ring\nbuffer, but before user space sets interrupt_mask to 0, the host could\nput another message in the ring buffer but it wouldn\u2019t interrupt.\nThen the next pread() would hang.\n\nFix these by removing all instances where interrupt_mask is changed,\nwhile keeping the one in set_event() unchanged to enable userspace\ncontrol the interrupt mask by writing 0/1 to /dev/uioX."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The driver\u0027s canonical deployment (documented in its own file header, and special-cased via `channel-\u003edevice_id == HV_NIC`) binds the netvsc NIC VMBus channel to uio_hv_generic for DPDK, so the inbound ring whose interrupt_mask is clobbered carries packets arriving from remote network peers on an internet-facing VM. A remote party sending traffic controls the message-arrival timing that decides whether the interrupt is permanently lost.\nAC:L - The vulnerable window recurs on every single inbound interrupt (`hv_uio_channel_cb()` sets mask=1 unconditionally) plus at each open and subchannel creation, so sustained traffic hits it essentially immediately rather than requiring a rare coincidence. Because the host only interrupts on an empty\u2192non-empty transition, a single successful hit wedges the channel permanently \u2014 no repeated win of a narrow race is needed.\nPR:N - In the netvsc/DPDK configuration the trigger is ordinary inbound packet traffic, requiring no account, credentials, or capability on the target guest. The pre-existing uio binding is administrator configuration, not a privilege the attacker must hold.\nUI:N - No victim action is required \u2014 the userspace VMBus driver (DPDK PMD or hv_fcopy_uio_daemon) is already running its normal mmap/clear-imask/pread loop, and the kernel writes the mask on its own during routine operation.\nS:U - The clobbered interrupt_mask and the resulting hang both stay inside the guest\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:N - The bug is a single control-bit write to a ring header field already fully visible to the mmap\u0027ing userspace driver; nothing is read out of bounds, no uninitialised memory is exposed, and no kernel address or heap state is disclosed.\nI:N - The attacker causes no data modification \u2014 the kernel writes the mask bit unconditionally as part of its own buggy logic, and no ring contents, packet data, or kernel structures are altered. The mask write is the defect\u0027s mechanism, whose sole observable consequence is the lost interrupt.\nA:H - The userspace VMBus driver blocks forever in `pread()` on `/dev/uioX` and never receives another interrupt, permanently killing the channel \u2014 total loss of the VM\u0027s userspace network data path for DPDK, or of the host-guest fcopy service \u2014 recoverable only by restarting the application. Per the hang/deadlock guidance this is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:21.676Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/540aac117eaea5723cef5e4cbf3035c4ac654d92"
        },
        {
          "url": "https://git.kernel.org/stable/c/65d40acd911c7011745cbbd2aaac34eb5266d11e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a44f61f878f32071d6378e8dd7c2d47f9490c8f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/01ce972e6f9974a7c76943bcb7e93746917db83a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2af39ab5e6dc46b835a52e80a22d0cad430985e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/37bd91f22794dc05436130d6983302cb90ecfe7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e29587c07537929684faa365027f4b0d87521e1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b15b7d2a1b09ef5428a8db260251897405a19496"
        }
      ],
      "title": "uio_hv_generic: Let userspace take care of interrupt mask",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40048",
    "datePublished": "2025-10-28T11:48:25.220Z",
    "dateReserved": "2025-04-16T07:20:57.156Z",
    "dateUpdated": "2026-10-15T22:02:36.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40048",
      "date": "2026-10-31",
      "epss": "0.00644",
      "percentile": "0.50877"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-29T01:04:10.000Z",
      "cve": "CVE-2025-40048",
      "id": "msrc_CVE-2025-40048",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "uio_hv_generic: Let userspace take care of interrupt mask",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40048.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/uio/uio_hv_generic.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "540aac117eaea5723cef5e4cbf3035c4ac654d92",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65d40acd911c7011745cbbd2aaac34eb5266d11e",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a44f61f878f32071d6378e8dd7c2d47f9490c8f7",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "01ce972e6f9974a7c76943bcb7e93746917db83a",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2af39ab5e6dc46b835a52e80a22d0cad430985e3",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "37bd91f22794dc05436130d6983302cb90ecfe7e",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e29587c07537929684faa365027f4b0d87521e1b",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b15b7d2a1b09ef5428a8db260251897405a19496",
                    "status": "affected",
                    "version": "95096f2fbd10186d3e78a328b327afc71428f65f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/uio/uio_hv_generic.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.10"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.301",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.246",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.195",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio_hv_generic: Let userspace take care of interrupt mask\n\nRemove the logic to set interrupt mask by default in uio_hv_generic\ndriver as the interrupt mask value is supposed to be controlled\ncompletely by the user space. If the mask bit gets changed\nby the driver, concurrently with user mode operating on the ring,\nthe mask bit may be set when it is supposed to be clear, and the\nuser-mode driver will miss an interrupt which will cause a hang.\n\nFor eg- when the driver sets inbound ring buffer interrupt mask to 1,\nthe host does not interrupt the guest on the UIO VMBus channel.\nHowever, setting the mask does not prevent the host from putting a\nmessage in the inbound ring buffer.\u00a0So let\u2019s assume that happens,\nthe host puts a message into the ring buffer but does not interrupt.\n\nSubsequently, the user space code in the guest sets the inbound ring\nbuffer interrupt mask to 0, saying \u201cHey, I\u2019m ready for interrupts\u201d.\nUser space code then calls pread() to wait for an interrupt.\nThen one of two things happens:\n\n* The host never sends another message. So the pread() waits forever.\n* The host does send another message. But because there\u2019s already a\n  message in the ring buffer, it doesn\u2019t generate an interrupt.\n  This is the correct behavior, because the host should only send an\n  interrupt when the inbound ring buffer transitions from empty to\n  not-empty. Adding an additional message to a ring buffer that is not\n  empty is not supposed to generate an interrupt on the guest.\n  Since the guest is waiting in pread() and not removing messages from\n  the ring buffer, the pread() waits forever.\n\nThis could be easily reproduced in hv_fcopy_uio_daemon if we delay\nsetting interrupt mask to 0.\n\nSimilarly if hv_uio_channel_cb() sets the interrupt_mask to 1,\nthere\u2019s a race condition. Once user space empties the inbound ring\nbuffer, but before user space sets interrupt_mask to 0, the host could\nput another message in the ring buffer but it wouldn\u2019t interrupt.\nThen the next pread() would hang.\n\nFix these by removing all instances where interrupt_mask is changed,\nwhile keeping the one in set_event() unchanged to enable userspace\ncontrol the interrupt mask by writing 0/1 to /dev/uioX."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nuio_hv_generic: Permitir que el espacio de usuario se encargue de la m\u00e1scara de interrupci\u00f3n\n\nEliminar la l\u00f3gica para establecer la m\u00e1scara de interrupci\u00f3n por defecto en el controlador uio_hv_generic, ya que el valor de la m\u00e1scara de interrupci\u00f3n se supone que debe ser controlado completamente por el espacio de usuario. Si el bit de m\u00e1scara es cambiado por el controlador, concurrentemente con el modo de usuario operando en el anillo, el bit de m\u00e1scara puede establecerse cuando se supone que debe estar despejado, y el controlador en modo de usuario perder\u00e1 una interrupci\u00f3n, lo que causar\u00e1 un cuelgue.\n\nPor ejemplo, cuando el controlador establece la m\u00e1scara de interrupci\u00f3n del b\u00fafer de anillo de entrada en 1, el anfitri\u00f3n no interrumpe al invitado en el canal UIO VMBus. Sin embargo, establecer la m\u00e1scara no impide que el anfitri\u00f3n coloque un mensaje en el b\u00fafer de anillo de entrada. As\u00ed que asumamos que eso sucede, el anfitri\u00f3n coloca un mensaje en el b\u00fafer de anillo pero no interrumpe.\n\nPosteriormente, el c\u00f3digo del espacio de usuario en el invitado establece la m\u00e1scara de interrupci\u00f3n del b\u00fafer de anillo de entrada en 0, diciendo \u0027Oye, estoy listo para las interrupciones\u0027. El c\u00f3digo del espacio de usuario luego llama a pread() para esperar una interrupci\u00f3n. Entonces sucede una de dos cosas:\n\n* El anfitri\u00f3n nunca env\u00eda otro mensaje. As\u00ed que pread() espera para siempre.\n* El anfitri\u00f3n s\u00ed env\u00eda otro mensaje. Pero como ya hay un mensaje en el b\u00fafer de anillo, no genera una interrupci\u00f3n. Este es el comportamiento correcto, porque el anfitri\u00f3n solo debe enviar una interrupci\u00f3n cuando el b\u00fafer de anillo de entrada transiciona de vac\u00edo a no vac\u00edo. Agregar un mensaje adicional a un b\u00fafer de anillo que no est\u00e1 vac\u00edo no se supone que debe generar una interrupci\u00f3n en el invitado. Dado que el invitado est\u00e1 esperando en pread() y no est\u00e1 eliminando mensajes del b\u00fafer de anillo, pread() espera para siempre.\n\nEsto podr\u00eda reproducirse f\u00e1cilmente en hv_fcopy_uio_daemon si retrasamos el establecimiento de la m\u00e1scara de interrupci\u00f3n en 0.\n\nDe manera similar, si hv_uio_channel_cb() establece la interrupt_mask en 1, hay una condici\u00f3n de carrera. Una vez que el espacio de usuario vac\u00eda el b\u00fafer de anillo de entrada, pero antes de que el espacio de usuario establezca interrupt_mask en 0, el anfitri\u00f3n podr\u00eda colocar otro mensaje en el b\u00fafer de anillo pero no interrumpir\u00eda. Entonces el siguiente pread() se colgar\u00eda.\n\nCorregir esto eliminando todas las instancias donde se cambia interrupt_mask, mientras se mantiene sin cambios la de set_event() para permitir que el espacio de usuario controle la m\u00e1scara de interrupci\u00f3n escribiendo 0/1 en /dev/uioX."
          }
        ],
        "id": "CVE-2025-40048",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-40048",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:56:26.830461Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-28T12:15:38.920",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/01ce972e6f9974a7c76943bcb7e93746917db83a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2af39ab5e6dc46b835a52e80a22d0cad430985e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/37bd91f22794dc05436130d6983302cb90ecfe7e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/540aac117eaea5723cef5e4cbf3035c4ac654d92"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/65d40acd911c7011745cbbd2aaac34eb5266d11e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a44f61f878f32071d6378e8dd7c2d47f9490c8f7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b15b7d2a1b09ef5428a8db260251897405a19496"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e29587c07537929684faa365027f4b0d87521e1b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:53:03+00:00",
      "cve": "CVE-2025-40048",
      "id": "CVE-2025-40048",
      "initial_release_date": "2025-10-28T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: uio_hv_generic: Let userspace take care of interrupt mask",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40048.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.