High · published May 9, 2025
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Reset IRTE to host control if *new* route isn't postable
Restore an IRTE back to host control (remapped or posted MSI mode) if the
*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of
the GSI routing type. Updating the IRTE if and only if the new GSI is an
MSI results in KVM leaving an IRTE posting to a vCPU.
The dangling IRTE can result in interrupts being incorrectly delivered to
the guest, and in the worst case scenario can result in use-after-free,
e.g. if the VM is torn down, but the underlying host IRQ isn't freed.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.4, < 5.10.237 | 5.10.237 |
| linux/linux_kernel | ≥ 5.11, < 5.15.181 | 5.15.181 |
| linux/linux_kernel | ≥ 5.16, < 6.1.136 | 6.1.136 |
| linux/linux_kernel | ≥ 6.2, < 6.6.89 | 6.6.89 |
| linux/linux_kernel | ≥ 6.7, < 6.12.26 | 6.12.26 |
| linux/linux_kernel | ≥ 6.13, < 6.14.5 | 6.14.5 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| debian/debian_linux | all versions | — |