Critical Vulnerability in Linux Kernel: KVM SMM Mode Handling Issue
Summary
CVE-2025-37957: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode on vCPU reset") addres... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources and enables software applications to communicate with the hardware. The kernel is crucial for system stability and security. This vulnerability specifically affects the Kernel-based Virtual Machine (KVM) subsystem, which allows the Linux kernel to function as a hypervisor for running virtual machines. The issue arises from improper handling of System Management Mode (SMM) during specific operations, potentially leading to system instability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-37957, occurs when the KVM subsystem fails to properly exit SMM mode during a SHUTDOWN interception. This oversight can lead to a WARN message being triggered, indicating a potential use-after-free scenario. The issue was discovered through testing with Syzkaller, where a sequence of invalid instructions caused a triple fault while the vCPU was in SMM. This situation can compromise the stability of the virtual machine and may lead to unexpected behavior or crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-37957 is a critical vulnerability in the Linux kernel's KVM subsystem that requires immediate attention. Users are advised to update their systems to the latest patched version to mitigate potential risks. Monitoring tools like Vulert can help keep track of vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37957 is a vulnerability in the Linux kernel's KVM subsystem that affects the handling of System Management Mode during SHUTDOWN interceptions.
This vulnerability can lead to system instability and unexpected behavior in virtual machines, potentially causing crashes or data loss.
If you are using Debian 12 or 13 with the Linux kernel, your system may be affected. It is advisable to check for updates and apply patches.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your manifest files like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by CVE-2025-37957 without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
