CVE-2025-37957

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception

Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode

on vCPU reset") addressed an issue where a triple fault occurring in

nested mode could lead to use-after-free scenarios. However, the commit

did not handle the analogous situation for System Management Mode (SMM).

This omission results in triggering a WARN when KVM forces a vCPU INIT

after SHUTDOWN interception while the vCPU is in SMM. This situation was

reprodused using Syzkaller by:

1) Creating a KVM VM and vCPU

2) Sending a KVM_SMI ioctl to explicitly enter SMM

3) Executing invalid instructions causing consecutive exceptions and

eventually a triple fault

The issue manifests as follows:

WARNING: CPU: 0 PID: 25506 at arch/x86/kvm/x86.c:12112

kvm_vcpu_reset+0x1d2/0x1530 arch/x86/kvm/x86.c:12112

Modules linked in:

CPU: 0 PID: 25506 Comm: syz-executor.0 Not tainted

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References