{"id":"DEBIAN-CVE-2025-40038","details":"In the Linux kernel, the following vulnerability has been resolved:  KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid  Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false.  SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and getting the instruction bytes to decode requires reading guest memory.  Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fastpath handlers run with IRQs disabled.   BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu  preempt_count: 1, expected: 0  INFO: lockdep is turned off.  irq event stamp: 30580  hardirqs last  enabled at (30579): [\u003cffffffffc08b2527\u003e] vcpu_run+0x1787/0x1db0 [kvm]  hardirqs last disabled at (30580): [\u003cffffffffb4f62e32\u003e] __schedule+0x1e2/0xed0  softirqs last  enabled at (30570): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210  softirqs last disabled at (30568): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210  CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G     U              6.16.0-smp--e6c618b51cfe-sleep #782 NONE  Tainted: [U]=USER  Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025  Call Trace:   \u003cTASK\u003e   dump_stack_lvl+0x7d/0xb0   __might_resched+0x271/0x290   __might_fault+0x28/0x80   kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]   kvm_fetch_guest_virt+0x92/0xc0 [kvm]   __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]   x86_decode_insn+0xd1/0x1010 [kvm]   x86_emulate_instruction+0x105/0x810 [kvm]   __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]   handle_fastpath_invd+0xc4/0x1a0 [kvm]   vcpu_run+0x11a1/0x1db0 [kvm]   kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]   kvm_vcpu_ioctl+0x578/0x6a0 [kvm]   __se_sys_ioctl+0x6d/0xb0   do_syscall_64+0x8a/0x2c0   entry_SYSCALL_64_after_hwframe+0x4b/0x53  RIP: 0033:0x7f479d57a94b   \u003c/TASK\u003e  Note, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid\"), but with different justification (KVM now grabs SRCU when skipping the instruction for other reasons).","modified":"2026-08-27T23:05:23.178710057Z","published":"2025-10-28T12:15:37.733Z","upstream":["CVE-2025-40038"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-40038"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.57-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40038.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.6-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40038.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}]}