CVE-2025-40102

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc4-00104-g10fd0285305d

Description The Linux kernel KVM component contains a flaw where it erroneously allows userspace to pend vCPU events for a vCPU that has not been initialized. This can lead to KVM interpreting uninitialized garbage for routing or injecting exceptions, potentially causing a kernel BUG. Specifically, the issue arises when the injection code and the hypervisor disagree on the vCPU's 32-bit EL1 status, leading to an illegal mode for AArch64 and triggering a bug in the exception target el() function. The issue is triggered by attempting to access vCPU events before the vCPU has been fully initialized.

Recommendations Update the Linux kernel to version 6.17.0-rc4-00104-g10fd0285305d or a later version that includes the fix.