linux-cve-announce - CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025121613-CVE-2025-68259-16e3@gregkh>
Date: Tue, 16 Dec 2025 15:45:16 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
instruction, discard the exception and retry the instruction if the code
stream is changed (e.g. by a different vCPU) between when the CPU
executes the instruction and when KVM decodes the instruction to get the
next RIP.

As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject
INT3/INTO instead of retrying the instruction"), failure to verify that
the correct INTn instruction was decoded can effectively clobber guest
state due to decoding the wrong instruction and thus specifying the
wrong next RIP.

The bug most often manifests as "Oops: int3" panics on static branch
checks in Linux guests.  Enabling or disabling a static branch in Linux
uses the kernel's "text poke" code patching mechanism.  To modify code
while other CPUs may be executing that code, Linux (temporarily)
replaces the first byte of the original instruction with an int3 (opcode
0xcc), then patches in the new code stream except for the first byte,
and finally replaces the int3 with the first byte of the new code
stream.  If a CPU hits the int3, i.e. executes the code while it's being
modified, then the guest kernel must look up the RIP to determine how to
handle the #BP, e.g. by emulating the new instruction.  If the RIP is
incorrect, then this lookup fails and the guest kernel panics.

The bug reproduces almost instantly by hacking the guest kernel to
repeatedly check a static branch[1] while running a drgn script[2] on
the host to constantly swap out the memory containing the guest's TSS.

[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b

The Linux kernel CVE team has assigned CVE-2025-68259 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.0 with commit 6ef88d6e36c2b4b3886ec9967cafabe4424d27d5 and fixed in 6.12.62 with commit 87cc1622c88a4888959d64fa1fc9ba1e264aa3d4
	Issue introduced in 6.0 with commit 6ef88d6e36c2b4b3886ec9967cafabe4424d27d5 and fixed in 6.17.12 with commit 54bcccc2c7805a00af1d7d2faffd6f424c0133aa
	Issue introduced in 6.0 with commit 6ef88d6e36c2b4b3886ec9967cafabe4424d27d5 and fixed in 6.18.1 with commit 53903ac9ca1abffa27327e85075ec496fa55ccf3
	Issue introduced in 6.0 with commit 6ef88d6e36c2b4b3886ec9967cafabe4424d27d5 and fixed in 6.19-rc1 with commit 4da3768e1820cf15cced390242d8789aed34f54d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-68259
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	arch/x86/include/asm/kvm_host.h
	arch/x86/kvm/svm/svm.c
	arch/x86/kvm/x86.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/87cc1622c88a4888959d64fa1fc9ba1e264aa3d4
	https://git.kernel.org/stable/c/54bcccc2c7805a00af1d7d2faffd6f424c0133aa
	https://git.kernel.org/stable/c/53903ac9ca1abffa27327e85075ec496fa55ccf3
	https://git.kernel.org/stable/c/4da3768e1820cf15cced390242d8789aed34f54d