CVE-2025-40300 x86/vmscape: Add conditional IBPB mitigation
A malicious guest VM can leak sensitive data from the host userspace hypervisor via branch predictor side-channels, requiring kernel patches to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40300?
CVE-2025-40300 is a medium-severity vulnerability in Debian Debian Linux, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/vmscape: Add conditional IBPB mitigation
VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit.
Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB.
This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace.
The intent is to integrate and optimize these cases post-embargo.
[ dhansen: elaborate on suboptimal IBPB solution ]
Which versions are affected by CVE-2025-40300?
It affects 2 products.
Linux distribution packages (1)
kernel-source openSUSE:Tumbleweed | All versions | 6.16.7-1.1 |
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-40300?
Apply the vendor's patch.
Is CVE-2025-40300 being exploited?
There is no known exploitation of CVE-2025-40300 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-67238, AZL-74763, BELL-CVE-2025-40300, DEBIAN-CVE-2025-40300, GHSA-x8qw-46ww-c957, ROOT-OS-DEBIAN-11-CVE-2025-40300 and 14 more.