01 Record

CVE-2025-40102

KVM: arm64: Prevent access to vCPU events before init

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

KVM: arm64: Prevent access to vCPU events before init

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.22% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 12.6% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Deferred. NVD last modified this record on 2026-10-19.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2025-10-30 09:48Z12 MO AGO
Last updated: 2026-09-02 12:49Z1 MO AGO
Reserved: 2025-04-16
Assigning CNA: Linux
Record state: PUBLISHED
Severity: Not rated by the issuing CNA
CNA CVSS vector: Not published by the issuing CNA
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 2cef76e3bb01c8ee5997de82da147a5bd8b6cbeafe4764681d24f54d40cbb528

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxb7b27facc7b50a5fce0afaa3df56157136ce181a to < b0ab34a9e4cd5b88b522cc156e792cefe3085334, b7b27facc7b50a5fce0afaa3df56157136ce181a to < d64461d38972302f0243498ff409b0d54e14e106, b7b27facc7b50a5fce0afaa3df56157136ce181a to < b498f0da45a388b40195f7198455c62fe366a372, b7b27facc7b50a5fce0afaa3df56157136ce181a to < 7b854e68365a84dfa984ee81268e10b9311ac9d2, b7b27facc7b50a5fce0afaa3df56157136ce181a to < c0fcd72e7eb50205dc20731033b0b1c67ecbe4dc, b7b27facc7b50a5fce0afaa3df56157136ce181a to < 64a04e6320fc5affbadc59dc7024d79f909bfe84, b7b27facc7b50a5fce0afaa3df56157136ce181a to < 0aa1b76fe1429629215a7c79820e4b96233ac4a3, 4.19—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/b0ab34a9e4cd5b88b522cc156e792cefe3085334
git.kernel.orghttps://git.kernel.org/stable/c/d64461d38972302f0243498ff409b0d54e14e106
git.kernel.orghttps://git.kernel.org/stable/c/b498f0da45a388b40195f7198455c62fe366a372
git.kernel.orghttps://git.kernel.org/stable/c/7b854e68365a84dfa984ee81268e10b9311ac9d2
git.kernel.orghttps://git.kernel.org/stable/c/c0fcd72e7eb50205dc20731033b0b1c67ecbe4dc
git.kernel.orghttps://git.kernel.org/stable/c/64a04e6320fc5affbadc59dc7024d79f909bfe84
git.kernel.orghttps://git.kernel.org/stable/c/0aa1b76fe1429629215a7c79820e4b96233ac4a3

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.111-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.17.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.