{
  "threat_severity" : "Moderate",
  "public_date" : "2025-10-28T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O",
    "id" : "2406712",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2406712"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-754",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nKVM: x86: Don't (re)check L1 intercepts when completing userspace I/O\nWhen completing emulation of instruction that generated a userspace exit\nfor I/O, don't recheck L1 intercepts as KVM has already finished that\nphase of instruction execution, i.e. has already committed to allowing L2\nto perform I/O.  If L1 (or host userspace) modifies the I/O permission\nbitmaps during the exit to userspace,  KVM will treat the access as being\nintercepted despite already having emulated the I/O access.\nPivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation.\nOf the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the\nintended \"recipient\") can reach the code in question.  gp_interception()'s\nuse is mutually exclusive with is_guest_mode(), and\ncomplete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with\nEMULTYPE_SKIP.\nThe bad behavior was detected by a syzkaller program that toggles port I/O\ninterception during the userspace I/O exit, ultimately resulting in a WARN\non vcpu->arch.pio.count being non-zero due to KVM no completing emulation\nof the I/O instruction.\nWARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm]\nModules linked in: kvm_intel kvm irqbypass\nCPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\nRIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm]\nPKRU: 55555554\nCall Trace:\n<TASK>\nkvm_fast_pio+0xd6/0x1d0 [kvm]\nvmx_handle_exit+0x149/0x610 [kvm_intel]\nkvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm]\nkvm_vcpu_ioctl+0x244/0x8c0 [kvm]\n__x64_sys_ioctl+0x8a/0xd0\ndo_syscall_64+0x5d/0xc60\nentry_SYSCALL_64_after_hwframe+0x4b/0x53\n</TASK>", "A flaw was found in the Kernel-based Virtual Machine (KVM) for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 (L1) intercepts during the completion of userspace I/O emulation for a Level 2 (L2) instruction. If the L1 or host userspace modifies I/O interception settings during this process, KVM may misinterpret already-emulated I/O as intercepted. This can lead to a kernel warning and potentially disrupt the guest virtual machine, resulting in a denial of service. Exploitation requires local access to /dev/kvm and the ability to perform nested virtualization or manipulate I/O bitmaps." ],
  "statement" : "KVM x86 was re-checking L1 instruction intercepts while completing a userspace I/O emulation for an L2 instruction. If L1 (or host userspace) modified I/O interception during the exit, KVM could wrongly treat the already-emulated I/O as intercepted and leave vcpu->arch.pio.count non-zero, triggering a WARN and potentially disrupting the guest.\nPractical exploitation requires local access to /dev/kvm and the ability to run nested virtualization or manipulate I/O bitmaps.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:49030",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "kernel-0:6.12.0-55.94.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-24T00:00:00Z",
    "advisory" : "RHSA-2026:45116",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.147.1.rt7.488.el8_10",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-24T00:00:00Z",
    "advisory" : "RHSA-2026:45115",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.147.1.el8_10",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-08-24T00:00:00Z",
    "advisory" : "RHSA-2026:59091",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.4",
    "package" : "kernel-0:4.18.0-305.201.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-08-24T00:00:00Z",
    "advisory" : "RHSA-2026:59091",
    "cpe" : "cpe:/o:redhat:rhel_eus_long_life:8.4",
    "package" : "kernel-0:4.18.0-305.201.1.el8_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:47869",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.8",
    "package" : "kernel-0:4.18.0-477.156.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:47869",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.8",
    "package" : "kernel-0:4.18.0-477.156.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-24T00:00:00Z",
    "advisory" : "RHSA-2026:45192",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.30.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-24T00:00:00Z",
    "advisory" : "RHSA-2026:45192",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.30.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-08-07T00:00:00Z",
    "advisory" : "RHSA-2026:51603",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "kernel-0:5.14.0-284.186.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-08-07T00:00:00Z",
    "advisory" : "RHSA-2026:51604",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.186.1.rt14.471.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:48386",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "kernel-0:5.14.0-427.141.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-07-31T00:00:00Z",
    "advisory" : "RHSA-2026:49031",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "kernel-0:5.14.0-570.131.1.el9_6"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.13",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:54187",
    "cpe" : "cpe:/a:redhat:openshift:4.13::el9",
    "package" : "rhcos-413.92.202608111330-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.14",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:56786",
    "cpe" : "cpe:/a:redhat:openshift:4.14::el9",
    "package" : "rhcos-414.92.202608172040-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.15",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:56911",
    "cpe" : "cpe:/a:redhat:openshift:4.15::el9",
    "package" : "rhcos-415.92.202608180329-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.16",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:56853",
    "cpe" : "cpe:/a:redhat:openshift:4.16::el9",
    "package" : "rhcos-416.94.202608150307-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.17",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:60019",
    "cpe" : "cpe:/a:redhat:openshift:4.17::el9",
    "package" : "rhcos-417.94.202608250221-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.18",
    "release_date" : "2026-08-19T00:00:00Z",
    "advisory" : "RHSA-2026:54544",
    "cpe" : "cpe:/a:redhat:openshift:4.18::el9",
    "package" : "rhcos-418.94.202608111829-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.19",
    "release_date" : "2026-08-19T00:00:00Z",
    "advisory" : "RHSA-2026:54553",
    "cpe" : "cpe:/a:redhat:openshift:4.19::el9",
    "package" : "rhcos-4.19.9.6.202608120446-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.20",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:54581",
    "cpe" : "cpe:/a:redhat:openshift:4.20::el9",
    "package" : "rhcos-4.20.9.6.202608121719-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.21",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:54599",
    "cpe" : "cpe:/a:redhat:openshift:4.21::el9",
    "package" : "rhcos-4.21.9.6.202608122143-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:54769",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "rhcos-4.22.9.8.202608130832-0"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux for NVIDIA 26",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/a:redhat:enterprise_linux_nvidia:"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-40026\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40026\nhttps://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T" ],
  "csaw" : true,
  "name" : "CVE-2025-40026",
  "mitigation" : {
    "value" : "This vulnerability can be mitigated by disabling nested virtualization. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53359-mitigation.conf`. In that file, disable nested virtualization for the `kvm_intel` and `kvm_amd` kernel modules:\n```\noptions kvm-intel nested=0\noptions kvm-amd nested=0\n```\nUse `lsmod` to determine if either module is already loaded. If so, remove loaded modules with `modprobe -r`. To validate that nested virtualization is disabled, read the files `/sys/module/kvm_intel/parameters/nested` and `/sys/module/kvm_amd/parameters/nested`. If these modules are loaded, those files should read `N` to indicate that the feature is disabled.\nIn OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example.\nhttps://access.redhat.com/solutions/6979679",
    "lang" : "en:us"
  }
}