CVE-2025-40181

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP

When running as an SNP or TDX guest under KVM, force the legacy PCI hole,

i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC

via a forced variable MTRR range.

In most KVM-based setups, legacy devices such as the HPET and TPM are

enumerated via ACPI. ACPI enumeration includes a Memory32Fixed entry, and

optionally a SystemMemory descriptor for an OperationRegion, e.g. if the

device needs to be accessed via a Control Method.

If a SystemMemory entry is present, then the kernel's ACPI driver will

auto-ioremap the region so that it can be accessed at will. However, the

ACPI spec doesn't provide a way to enumerate the memory type of

SystemMemory regions, i.e. there's no way to tell software that a region

must be mapped as UC vs. WB, etc. As a result, Linux's ACPI driver always

maps SystemMemory regions using ioremap_cache(), i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References