CVE-2025-40160

xen/events: Return -EEXIST for bound VIRQs

N/A
Published: November 12, 2025 at 10:24 AM UTC
Updated: October 19, 2026 at 09:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards. Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON(). A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.262cc5fc7b2e0218144e162afb8191db9b924b5e6
Vendor states this is fixed in 07ce121d93a5e5fb2440a24da3dbf408fcee978e (fixed)
Vendor states this is fixed in 612ef6056855c0aacb9b25d1d853c435754483f7 (fixed)
Vendor states this is fixed in a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa (fixed)
Vendor states this is fixed in f81db055a793eca9d05f79658ff62adafb41d664 (fixed)
Vendor states this is fixed in 3.2 (unaffected)
Vendor states this is fixed in 6.12.54 (unaffected)
Vendor states this is fixed in 6.17.4 (unaffected)
Vendor states this is fixed in 6.18 (unaffected)
Vendor states this is fixed in 6.6.113 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card