CVE-2025-40160 xen/events: Return -EEXIST for bound VIRQs
A local attacker can trigger a kernel crash by attempting to bind a virtual IRQ to a different CPU than its current binding.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40160?
CVE-2025-40160 is a denial of service vulnerability in Linux, published on 12 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xen/events: Return -EEXIST for bound VIRQs
Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards.
Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON().
A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.
Which versions are affected by CVE-2025-40160?
How do I fix CVE-2025-40160?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40160 being exploited?
There is no known exploitation of CVE-2025-40160 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40160, DEBIAN-CVE-2025-40160, GHSA-86vm-hhg5-pm6h, ROOT-OS-DEBIAN-11-CVE-2025-40160, ROOT-OS-DEBIAN-12-CVE-2025-40160, ROOT-OS-DEBIAN-13-CVE-2025-40160 and 3 more.