{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-40038 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-40038 is a high-severity denial of service vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-40038 and fix it if it is affected.\n\nWhat it is: CVE-2025-40038 is a high-severity denial of service vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-40038 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-40038/ (Markdown: https://insights.sbomify.com/CVE-2025-40038/index.md)","id":"CVE-2025-40038","markdown":"https://insights.sbomify.com/CVE-2025-40038/index.md","name":"CVE-2025-40038","record":{"aliases":["BELL-CVE-2025-40038","DEBIAN-CVE-2025-40038","GHSA-c4m5-3mj6-4mp6","ROOT-OS-DEBIAN-13-CVE-2025-40038","ROOT-OS-UBUNTU-2404-CVE-2025-40038","UBUNTU-CVE-2025-40038"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel KVM","requires_auth":"none","summary":"A guest VM can trigger a kernel crash in the Linux KVM SVM module by causing a sleep in an atomic context during instruction emulation.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid\n\nSkip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP\nisn't valid, e.g. because KVM is running with nrips=false.  SVM must\ndecode and emulate to skip the instruction if the CPU doesn't provide the\nnext RIP, and getting the instruction bytes to decode requires reading\nguest memory.  Reading guest memory through the emulator can fault, i.e.\ncan sleep, which is disallowed since the fastpath handlers run with IRQs\ndisabled.\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu\n preempt_count: 1, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 30580\n hardirqs last  enabled at (30579): [\u003cffffffffc08b2527\u003e] vcpu_run+0x1787/0x1db0 [kvm]\n hardirqs last disabled at (30580): [\u003cffffffffb4f62e32\u003e] __schedule+0x1e2/0xed0\n softirqs last  enabled at (30570): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210\n softirqs last disabled at (30568): [\u003cffffffffb4247a64\u003e] fpu_swap_kvm_fpstate+0x44/0x210\n CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G     U              6.16.0-smp--e6c618b51cfe-sleep #782 NONE\n Tainted: [U]=USER\n Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x7d/0xb0\n  __might_resched+0x271/0x290\n  __might_fault+0x28/0x80\n  kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]\n  kvm_fetch_guest_virt+0x92/0xc0 [kvm]\n  __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]\n  x86_decode_insn+0xd1/0x1010 [kvm]\n  x86_emulate_instruction+0x105/0x810 [kvm]\n  __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]\n  handle_fastpath_invd+0xc4/0x1a0 [kvm]\n  vcpu_run+0x11a1/0x1db0 [kvm]\n  kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]\n  kvm_vcpu_ioctl+0x578/0x6a0 [kvm]\n  __se_sys_ioctl+0x6d/0xb0\n  do_syscall_64+0x8a/0x2c0\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f479d57a94b\n  \u003c/TASK\u003e\n\nNote, this is essentially a reapply of commit 5c30e8101e8d (\"KVM: SVM:\nSkip WRMSR fastpath on VM-Exit if next RIP isn't valid\"), but with\ndifferent justification (KVM now grabs SRCU when skipping the instruction\nfor other reasons).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid","id":"CVE-2025-40038","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":0,"n_references":4,"next":{"headline":"ksmbd: Fix race condition in RPC handle list access","id":"CVE-2025-40039"},"packages":[],"prev":{"headline":"fbdev: simplefb: Fix use after free in simplefb_detach_genpds()","id":"CVE-2025-40037"},"products":["Linux"],"published":"2025-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A guest VM can trigger a kernel crash in the Linux KVM SVM module by causing a sleep in an atomic context during instruction emulation.","url":"https://insights.sbomify.com/CVE-2025-40038/"}