7.9

CVE-2025-40026: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

Deferred
AliasesRHSA-2026:68131RHSA-2026:78843RHSA-2026:78844
Published 28-10-2025Last modified 15-10-2026

Vulnerability summary

CVE-2025-40026 is a high (CVSS 7.9) vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.9, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.9/10
010
High · v3.1 (CVE.org)
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 44 · Related 29
DLA-4379-1DLA-4404-1DSA-6053-1MGASA-2025-0309MGASA-2025-0310OPENSUSE-SU-2025:15702-1

Timeline

  1. 28-10-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu148 products
  • linuxAll versions (No fix recorded) | < 5.15.0-170.180 | < 6.8.0-106.106 | < 6.17.0-7.7
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1100.107 | < 6.8.0-1050.53 | < 6.17.0-1004.4
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Redhat46 products
  • bpftool< 0:3.10.0-1160.165.1.el7 | < 0:4.18.0-372.214.1.el8_6
  • bpftool-debuginfo< 0:3.10.0-1160.165.1.el7 | < 0:4.18.0-372.214.1.el8_6
  • kernel< 0:3.10.0-1160.165.1.el7 | < 0:4.18.0-372.214.1.el8_6
  • kernel-abi-stablelists< 0:4.18.0-372.214.1.el8_6
  • kernel-abi-whitelists< 0:3.10.0-1160.165.1.el7
Debian1 product
  • linux< 6.1.158-1 | < 6.12.57-1 | < 6.17.6-1
Linux1 product
  • linux≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < a908eca437789589dd4624da428614c1275064dc | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < 00338255bb1f422642fb2798ebe92e93b6e4209b | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < e0ce3ed1048a47986d15aef1a98ebda25560d257 | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < ba35a5d775799ce5ad60230be97336f2fefd518e | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < 3d3abf3f7e8b1abb082070a343de82d7efc80523 | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < e7177c7e32cb806f348387b7f4faafd4a5b32054 | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < 3a062a5c55adc5507600b9ae6d911e247e2f1d6e | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < 7366830642505683bbe905a2ba5d18d6e4b512b8 | ≥ 8a76d7f25f8f24fc5a328c8e15e4a7313cf141b9, < e750f85391286a4c8100275516973324b621a269 | 3.0

4 vendors · 196 products

References

50 links
Show all 50 references