Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-37849

KVM: arm64: Tear down vGIC on failed vCPU creation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 6211753fdfd05af9e08f54c8d0ba3ee516034878 to < 07476e0d932afc53c05468076393ac35d0b4999eaffected
  • 6211753fdfd05af9e08f54c8d0ba3ee516034878 to < 5085e02362b9948f82fceca979b8f8e12acb1cc5affected
  • 6211753fdfd05af9e08f54c8d0ba3ee516034878 to < c322789613407647a05ff5c451a7bf545fb34e73affected
  • 6211753fdfd05af9e08f54c8d0ba3ee516034878 to < 2480326eba8ae9ccc5e4c3c2dc8d407db68e3c52affected
  • 6211753fdfd05af9e08f54c8d0ba3ee516034878 to < f1e9087abaeedec9bf2894a282ee4f0d8383f299affected
  • 6211753fdfd05af9e08f54c8d0ba3ee516034878 to < 250f25367b58d8c65a1b060a2dda037eea09a672affected

Linux Linux

Default version status: affected

  • 3.11affected
  • 0 to < 3.11unaffected
  • 6.1.135 to ≤ 6.1.*unaffected
  • 6.6.88 to ≤ 6.6.*unaffected
  • 6.12.24 to ≤ 6.12.*unaffected
  • 6.13.12 to ≤ 6.13.*unaffected
  • 6.14.3 to ≤ 6.14.*unaffected
  • 6.15 to ≤ *unaffected

References