CVE-2025-40038

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid

Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP

isn't valid, e.g. because KVM is running with nrips=false. SVM must

decode and emulate to skip the instruction if the CPU doesn't provide the

next RIP, and getting the instruction bytes to decode requires reading

guest memory. Reading guest memory through the emulator can fault, i.e.

can sleep, which is disallowed since the fastpath handlers run with IRQs

disabled.

BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106

in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu

preempt_count: 1, expected: 0

INFO: lockdep is turned off.

irq event stamp: 30580

hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm]

hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0

softi

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References