KVM Instruction Emulation Vulnerability in Linux Kernel: CVE-2025-40026
Summary
DEBIAN-CVE-2025-40026: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O,... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It supports various functionalities, including process management, memory management, and device control. This vulnerability affects the KVM (Kernel-based Virtual Machine) module, which allows the Linux kernel to act as a hypervisor, enabling multiple virtual machines to run on a single physical host. The vulnerability arises from improper handling of I/O permissions during userspace exits, potentially leading to security risks.
Vulnerability Detail
In the Linux kernel, specifically within the KVM module, a vulnerability has been identified where L1 intercepts are incorrectly rechecked when completing userspace I/O. This flaw can occur if L1 or host userspace modifies the I/O permission bitmaps during the exit to userspace, causing KVM to treat the access as intercepted despite having already emulated the I/O access. This behavior was detected by a syzkaller program, which toggles port I/O interception during the userspace I/O exit, leading to warnings about incomplete emulation of the I/O instruction. The vulnerability can result in unexpected behavior and potential security risks in virtualized environments.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid modifying the I/O permission bitmaps during userspace exits. However, this is not a permanent solution and updating the kernel is strongly recommended.
Conclusion
CVE-2025-40026 is a significant vulnerability in the Linux kernel's KVM module that can lead to security risks in virtualized environments. It is crucial for users to update their systems to the latest patched version to mitigate these risks. Temporary workarounds exist, but they are not substitutes for a proper update.
See every vulnerability recorded for linux →
FAQ
CVE-2025-40026 is a vulnerability in the Linux kernel's KVM module that affects the handling of I/O permissions during userspace exits.
This vulnerability can lead to unexpected behavior in virtual machines, potentially compromising the security of the host system.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If an immediate update is not possible, avoid modifying I/O permission bitmaps during userspace exits as a temporary workaround.
More information can be found in the official CVE database and security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
