{"id":"DEBIAN-CVE-2025-23141","details":"In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses  Acquire a lock on kvm-\u003esrcu when userspace is getting MP state to handle a rather extreme edge case where \"accepting\" APIC events, i.e. processing pending INIT or SIPI, can trigger accesses to guest memory.  If the vCPU is in L2 with INIT *and* a TRIPLE_FAULT request pending, then getting MP state will trigger a nested VM-Exit by way of -\u003echeck_nested_events(), and emuating the nested VM-Exit can access guest memory.  The splat was originally hit by syzkaller on a Google-internal kernel, and reproduced on an upstream kernel by hacking the triple_fault_event_test selftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a memory access on VMX), and do vcpu_mp_state_get() to trigger the scenario.    =============================   WARNING: suspicious RCU usage   6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted   -----------------------------   include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage!    other info that might help us debug this:    rcu_scheduler_active = 2, debug_locks = 1   1 lock held by triple_fault_ev/1256:    #0: ffff88810df5a330 (&vcpu-\u003emutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm]    stack backtrace:   CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x7f/0x90    lockdep_rcu_suspicious+0x144/0x190    kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm]    kvm_vcpu_read_guest+0x3e/0x90 [kvm]    read_and_check_msr_entry+0x2e/0x180 [kvm_intel]    __nested_vmx_vmexit+0x550/0xde0 [kvm_intel]    kvm_check_nested_events+0x1b/0x30 [kvm]    kvm_apic_accept_events+0x33/0x100 [kvm]    kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm]    kvm_vcpu_ioctl+0x33e/0x9a0 [kvm]    __x64_sys_ioctl+0x8b/0xb0    do_syscall_64+0x6c/0x170    entry_SYSCALL_64_after_hwframe+0x4b/0x53    \u003c/TASK\u003e","modified":"2026-09-01T16:06:11.159762953Z","published":"2025-05-01T13:15:49.910Z","upstream":["CVE-2025-23141"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-23141"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.135-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-23141.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-23141.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-23141.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}