Interrupt Mask Control Vulnerability in Linux Kernel - CVE-2025-40048
Summary
DEBIAN-CVE-2025-40048: In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt ma... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. The kernel is critical for system stability and performance, and vulnerabilities within it can have severe implications for security and functionality.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2025-40048 has been discovered in the uio_hv_generic driver. This vulnerability arises from improper handling of the interrupt mask, which is supposed to be controlled entirely by user space. If the driver modifies the interrupt mask concurrently with user space operations, it can lead to missed interrupts and system hangs. Specifically, when the driver sets the inbound ring buffer interrupt mask to 1, the host does not interrupt the guest, causing user space to wait indefinitely for an interrupt that never occurs. This race condition can be reproduced in specific scenarios, leading to potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid changing the interrupt mask in the driver while allowing user space to control it. This can be done by ensuring that the interrupt_mask is not modified in the driver code, except for the instance in set_event() where user space can write 0 or 1 to /dev/uioX.
Conclusion
The CVE-2025-40048 vulnerability in the Linux kernel's uio_hv_generic driver poses a significant risk by allowing improper control of the interrupt mask, which can lead to system hangs. It is crucial for users to update their systems to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-40048 is a vulnerability in the Linux kernel's uio_hv_generic driver that allows improper control of the interrupt mask, potentially leading to system hangs.
This vulnerability can cause user space applications to hang indefinitely while waiting for interrupts, leading to denial of service.
You should update your Linux package to the latest version that includes the patch for CVE-2025-40048.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without needing to access the code.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
