CVE-2025-21779

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel

Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and

only if the local API is emulated/virtualized by KVM, and explicitly reject

said hypercalls if the local APIC is emulated in userspace, i.e. don't rely

on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID.

Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if

Hyper-V enlightenments are exposed to the guest without an in-kernel local

APIC:

dump_stack+0xbe/0xfd

__kasan_report.cold+0x34/0x84

kasan_report+0x3a/0x50

__apic_accept_irq+0x3a/0x5c0

kvm_hv_send_ipi.isra.0+0x34e/0x820

kvm_hv_hypercall+0x8d9/0x9d0

kvm_emulate_hypercall+0x506/0x7e0

__vmx_handle_exit+0x283/0xb60

vmx_handle_exit+0x1d/0xd0

vcpu_enter_guest+0x16b0/0x24c0

vcpu_run+0xc0/0x550

kvm_arch_vcpu_ioctl_run+0x170/0x6d0

kvm_vcpu_ioctl+0x413/0xb20

__se_sys_ioctl+0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References