7.8

CVE-2025-39823

KVM: x86: use array_index_nospec with indices that come from guest

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: use array_index_nospec with indices that come from guest

min and dest_id are guest-controlled indices. Using array_index_nospec()
after the bounds checks clamps these values to mitigate speculative execution
side-channels.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.19 < 5.4.298
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.242
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.191
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.150
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.104
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.45
Linux ≫ Linux Kernel Version >= 6.13 < 6.16.5
Linux ≫ Linux Kernel Version6.17 Updaterc1
Linux ≫ Linux Kernel Version6.17 Updaterc2
Linux ≫ Linux Kernel Version6.17 Updaterc3
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.06
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-129 Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

https://git.kernel.org/stable/c/72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48
Patch
https://git.kernel.org/stable/c/31a0ad2f60cb4816e06218b63e695eb72ce74974
Patch
https://git.kernel.org/stable/c/d51e381beed5e2f50f85f49f6c90e023754efa12
Patch
https://git.kernel.org/stable/c/33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f
Patch
https://git.kernel.org/stable/c/f49161646e03d107ce81a99c6ca5da682fe5fb69
Patch
https://git.kernel.org/stable/c/67a05679621b7f721bdba37a5d18665d3aceb695
Patch
https://git.kernel.org/stable/c/f57a4bd8d6cb5af05b8ac1be9098e249034639fb
Patch
https://git.kernel.org/stable/c/c87bd4dd43a624109c3cc42d843138378a7f4548
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory
Mailing List
https://cert-portal.siemens.com/productcert/html/ssa-032379.html