CVE-2025-37885

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Reset IRTE to host control if *new* route isn't postable

Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing type. Updating the IRTE if and only if the new GSI is an MSI results in KVM leaving an IRTE posting to a vCPU.

The dangling IRTE can result in interrupts being incorrectly delivered to the guest, and in the worst case scenario can result in use-after-free, e.g. if the VM is torn down, but the underlying host IRQ isn't freed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= efc644048ecde54f016011fe10110addd0de348f, < e5f2dee9f7fcd2ff4b97869f3c66a0d89c167769; >= efc644048ecde54f016011fe10110addd0de348f, < 116c7d35b8f72eac383b9fd371d7c1a8ffc2968b; >= efc644048ecde54f016011fe10110addd0de348f, < 023816bd5fa46fab94d1e7917fe131b79ed1fb41; >= efc644048ecde54f016011fe10110addd0de348f, < 3481fd96d801715942b6f69fe251133128156f30; >= efc644048ecde54f016011fe10110addd0de348f, < b5de7ac74f69603ad803c524b840bffd36368fc3; >= efc644048ecde54f016011fe10110addd0de348f, < 3066ec21d1a33896125747f68638725f456308db; >= efc644048ecde54f016011fe10110addd0de348f, < 9bcac97dc42d2f4da8229d18feb0fe2b1ce523a2
LinuxLinux4.4

References

Timeline

Published
May 9, 2025
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-378865.5In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of q_info Make the wait_context a fulCVE-2025-378875.5In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW CVE-2025-378885.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() Add NCVE-2025-378895.5In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platform_max as control value This reverCVE-2025-37895.4A vulnerability was found in baseweb JSite 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of thCVE-2025-378907.8In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qCVE-2025-378917.8In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conCVE-2025-378927.8In the Linux kernel, the following vulnerability has been resolved: mtd: inftlcore: Add error check for inftl_read_oob() In INFTL_findwritCVE-2025-378935.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in build_prologue() Vincent reporCVE-2025-378945.5In the Linux kernel, the following vulnerability has been resolved: net: use sock_gen_put() when sk_state is TCP_TIME_WAIT It is possible CVE-2025-378955.5In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix error handling path in bnxt_init_chip() WARN_ON() is trigCVE-2025-378965.5In the Linux kernel, the following vulnerability has been resolved: spi: spi-mem: Add fix to avoid divide error For some SPI flash memory
CVE-2025-37885: High severity, CVSS 7.8 | Vulnix