Vulnerability-Lookup

RHSA-2026:78843

Vulnerability from csaf_redhat - Published: 2026-10-08 06:54 - Updated: 2026-10-30 09:26

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Moderate

Notes

Topic: An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-40026

A flaw was found in the Kernel-based Virtual Machine (KVM) for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 (L1) intercepts during the completion of userspace I/O emulation for a Level 2 (L2) instruction. If the L1 or host userspace modifies I/O interception settings during this process, KVM may misinterpret already-emulated I/O as intercepted. This can lead to a kernel warning and potentially disrupt the guest virtual machine, resulting in a denial of service. Exploitation requires local access to /dev/kvm and the ability to perform nested virtualization or manipulate I/O bitmaps.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

9 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:78843	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2406712	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-40026	self
https://bugzilla.redhat.com/show_bug.cgi?id=2406712	external
https://www.cve.org/CVERecord?id=CVE-2025-40026	external
https://nvd.nist.gov/vuln/detail/CVE-2025-40026	external
https://lore.kernel.org/linux-cve-announce/202510…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:78843",
        "url": "https://access.redhat.com/errata/RHSA-2026:78843"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2406712",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406712"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_78843.json"
      }
    ],
    "title": "Red Hat Security Advisory: kernel-rt security update",
    "tracking": {
      "current_release_date": "2026-10-30T09:26:07+00:00",
      "generator": {
        "date": "2026-10-30T09:26:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:78843",
      "initial_release_date": "2026-10-08T06:54:43+00:00",
      "revision_history": [
        {
          "date": "2026-10-08T06:54:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-08T06:54:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T09:26:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
                "product": {
                  "name": "Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
                  "product_id": "7Server-RT-ELS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras_rt_els:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
                "product": {
                  "name": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
                  "product_id": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@3.10.0-1160.165.1.rt56.1317.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-devel@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-devel@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace-devel@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                "product": {
                  "name": "kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_id": "kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-trace-debuginfo@3.10.0-1160.165.1.rt56.1317.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
                "product": {
                  "name": "kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
                  "product_id": "kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-doc@3.10.0-1160.165.1.rt56.1317.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src"
        },
        "product_reference": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch"
        },
        "product_reference": "kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64 as a component of Red Hat Enterprise Linux for Real Time (v. 7 ELS)",
          "product_id": "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        },
        "product_reference": "kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
        "relates_to_product_reference": "7Server-RT-ELS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-40026",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "discovery_date": "2025-10-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406712"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Kernel-based Virtual Machine (KVM) for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 (L1) intercepts during the completion of userspace I/O emulation for a Level 2 (L2) instruction. If the L1 or host userspace modifies I/O interception settings during this process, KVM may misinterpret already-emulated I/O as intercepted. This can lead to a kernel warning and potentially disrupt the guest virtual machine, resulting in a denial of service. Exploitation requires local access to /dev/kvm and the ability to perform nested virtualization or manipulate I/O bitmaps.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "KVM x86 was re-checking L1 instruction intercepts while completing a userspace I/O emulation for an L2 instruction. If L1 (or host userspace) modified I/O interception during the exit, KVM could wrongly treat the already-emulated I/O as intercepted and leave vcpu-\u003earch.pio.count non-zero, triggering a WARN and potentially disrupting the guest.\nPractical exploitation requires local access to /dev/kvm and the ability to run nested virtualization or manipulate I/O bitmaps.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
          "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
          "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
          "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-40026"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406712",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406712"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-40026",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-40026"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-40026",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40026"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T"
        }
      ],
      "release_date": "2025-10-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-08T06:54:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:78843"
        },
        {
          "category": "workaround",
          "details": "This vulnerability can be mitigated by disabling nested virtualization. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53359-mitigation.conf`. In that file, disable nested virtualization for the `kvm_intel` and `kvm_amd` kernel modules:\n```\noptions kvm-intel nested=0\noptions kvm-amd nested=0\n```\n\nUse `lsmod` to determine if either module is already loaded. If so, remove loaded modules with `modprobe -r`. To validate that nested virtualization is disabled, read the files `/sys/module/kvm_intel/parameters/nested` and `/sys/module/kvm_amd/parameters/nested`. If these modules are loaded, those files should read `N` to indicate that the feature is disabled.\n\nIn OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example.\n\nhttps://access.redhat.com/solutions/6979679",
          "product_ids": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.src",
            "7Server-RT-ELS:kernel-rt-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debug-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-debuginfo-common-x86_64-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-doc-0:3.10.0-1160.165.1.rt56.1317.el7.noarch",
            "7Server-RT-ELS:kernel-rt-trace-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-debuginfo-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64",
            "7Server-RT-ELS:kernel-rt-trace-devel-0:3.10.0-1160.165.1.rt56.1317.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O"
    }
  ]
}

CVE-2025-40026 (GCVE-0-2025-40026)

Vulnerability from cvelistv5 – Published: 2025-10-28 09:32 – Updated: 2026-10-15 22:02

Title

KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>

Severity

7.9 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:56 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/a908eca437789589d…
https://git.kernel.org/stable/c/00338255bb1f42264…
https://git.kernel.org/stable/c/e0ce3ed1048a47986…
https://git.kernel.org/stable/c/ba35a5d775799ce5a…
https://git.kernel.org/stable/c/3d3abf3f7e8b1abb0…
https://git.kernel.org/stable/c/e7177c7e32cb806f3…
https://git.kernel.org/stable/c/3a062a5c55adc5507…
https://git.kernel.org/stable/c/7366830642505683b…
https://git.kernel.org/stable/c/e750f85391286a4c8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < a908eca437789589dd4624da428614c1275064dc (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < 00338255bb1f422642fb2798ebe92e93b6e4209b (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < e0ce3ed1048a47986d15aef1a98ebda25560d257 (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < ba35a5d775799ce5ad60230be97336f2fefd518e (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < 3d3abf3f7e8b1abb082070a343de82d7efc80523 (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < e7177c7e32cb806f348387b7f4faafd4a5b32054 (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < 3a062a5c55adc5507600b9ae6d911e247e2f1d6e (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < 7366830642505683bbe905a2ba5d18d6e4b512b8 (git) Affected: 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9 , < e750f85391286a4c8100275516973324b621a269 (git)
Linux	Linux	Affected: 3.0 Unaffected: 0 , < 3.0 (semver) Unaffected: 5.4.301 , ≤ 5.4.* (semver) Unaffected: 5.10.246 , ≤ 5.10.* (semver) Unaffected: 5.15.195 , ≤ 5.15.* (semver) Unaffected: 6.1.157 , ≤ 6.1.* (semver) Unaffected: 6.6.111 , ≤ 6.6.* (semver) Unaffected: 6.12.52 , ≤ 6.12.* (semver) Unaffected: 6.16.12 , ≤ 6.16.* (semver) Unaffected: 6.17.2 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40026",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:56:14.274469Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:36.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/emulate.c",
            "arch/x86/kvm/kvm_emulate.h",
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a908eca437789589dd4624da428614c1275064dc",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "00338255bb1f422642fb2798ebe92e93b6e4209b",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "e0ce3ed1048a47986d15aef1a98ebda25560d257",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "ba35a5d775799ce5ad60230be97336f2fefd518e",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "3d3abf3f7e8b1abb082070a343de82d7efc80523",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "e7177c7e32cb806f348387b7f4faafd4a5b32054",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "3a062a5c55adc5507600b9ae6d911e247e2f1d6e",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "7366830642505683bbe905a2ba5d18d6e4b512b8",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            },
            {
              "lessThan": "e750f85391286a4c8100275516973324b621a269",
              "status": "affected",
              "version": "8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/emulate.c",
            "arch/x86/kvm/kvm_emulate.h",
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "lessThan": "3.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.157",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.111",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.52",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.12",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.2",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O\n\nWhen completing emulation of instruction that generated a userspace exit\nfor I/O, don\u0027t recheck L1 intercepts as KVM has already finished that\nphase of instruction execution, i.e. has already committed to allowing L2\nto perform I/O.  If L1 (or host userspace) modifies the I/O permission\nbitmaps during the exit to userspace,  KVM will treat the access as being\nintercepted despite already having emulated the I/O access.\n\nPivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation.\nOf the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the\nintended \"recipient\") can reach the code in question.  gp_interception()\u0027s\nuse is mutually exclusive with is_guest_mode(), and\ncomplete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with\nEMULTYPE_SKIP.\n\nThe bad behavior was detected by a syzkaller program that toggles port I/O\ninterception during the userspace I/O exit, ultimately resulting in a WARN\non vcpu-\u003earch.pio.count being non-zero due to KVM no completing emulation\nof the I/O instruction.\n\n  WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm]\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm]\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_fast_pio+0xd6/0x1d0 [kvm]\n   vmx_handle_exit+0x149/0x610 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm]\n   kvm_vcpu_ioctl+0x244/0x8c0 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0x5d/0xc60\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires either `KVM_RUN`/`ioctl()` access to `/dev/kvm` on the host or code execution inside a guest running a nested hypervisor; there is no network-reachable path to `x86_emulate_insn()`.\nAC:L - The syzkaller reproducer deterministically toggles the port-I/O bitmap while servicing the `KVM_EXIT_IO` exit, and the guest-side variant only needs a second L1 vCPU to write the bitmap page \u2014 the attacker controls both sides of the window, and nested virt is enabled by default on kvm_intel/kvm_amd.\nPR:L - The attacker needs only unprivileged access to `/dev/kvm` (commonly granted via the `kvm` group or a VMM process), or ordinary code execution inside a guest; no root or CAP_SYS_ADMIN in the init namespace is required.\nUI:N - The vCPU thread reaches the buggy re-check on the normal `KVM_RUN` re-entry path after a userspace I/O exit; no victim action is needed.\nS:C - A guest (L1/L2) triggers corrupted state and a WARN/panic in the host kernel\u0027s KVM module, crossing the guest-to-host security boundary, and the aborted emulation also crosses the L1/L2 authority boundary by delivering an I/O intercept L1 never legitimately received.\nC:L - The stale `pio.count`/`pio.size` makes the next emulated `in` take the completion path and hand back data captured during the earlier I/O read on L2\u0027s behalf, leaking bounded `pio_data` contents across the L1/L2 boundary; the copy is capped at the 1024-byte `read_cache`, so it is not an arbitrary read.\nI:L - KVM injects a nested IOIO VM-exit to L1 for an access it already performed against the host device model (double execution) and subsequently substitutes stale `pio_data` for a real port read, corrupting guest I/O state in a limited, non-arbitrary way.\nA:H - The un-cleared `vcpu-\u003earch.pio.count` trips `WARN_ON_ONCE()` in `emulator_pio_in_out()` in the host kernel \u2014 a full host panic on the widely deployed `panic_on_warn=1` configuration \u2014 and leaves the vCPU with permanently desynchronized emulation state."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:08.793Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a908eca437789589dd4624da428614c1275064dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/00338255bb1f422642fb2798ebe92e93b6e4209b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0ce3ed1048a47986d15aef1a98ebda25560d257"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba35a5d775799ce5ad60230be97336f2fefd518e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d3abf3f7e8b1abb082070a343de82d7efc80523"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7177c7e32cb806f348387b7f4faafd4a5b32054"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a062a5c55adc5507600b9ae6d911e247e2f1d6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7366830642505683bbe905a2ba5d18d6e4b512b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e750f85391286a4c8100275516973324b621a269"
        }
      ],
      "title": "KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40026",
    "datePublished": "2025-10-28T09:32:33.075Z",
    "dateReserved": "2025-04-16T07:20:57.152Z",
    "dateUpdated": "2026-10-15T22:02:36.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted