What’s Vulnerable › Vulnerabilities

CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-09 · updated 2026-07-30
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Affected products

• Debian Linux: 11.0
• Linux kernel: before 6.1.135; from 6.2 before 6.6.88; from 6.7 before 6.12.24; from 6.13 before 6.13.12; from 6.14 before 6.14.3 — fixed in 6.1.135, 6.12.24, 6.13.12, 6.14.3, 6.6.88

How to fix

Upgrade to a fixed version: Linux kernel 6.1.135, 6.12.24, 6.13.12, 6.14.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/07476e0d932afc53c05468076393ac35d0b4999e
• https://git.kernel.org/stable/c/2480326eba8ae9ccc5e4c3c2dc8d407db68e3c52
• https://git.kernel.org/stable/c/250f25367b58d8c65a1b060a2dda037eea09a672
• https://git.kernel.org/stable/c/5085e02362b9948f82fceca979b8f8e12acb1cc5
• https://git.kernel.org/stable/c/c322789613407647a05ff5c451a7bf545fb34e73
• https://git.kernel.org/stable/c/f1e9087abaeedec9bf2894a282ee4f0d8383f299
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2025-37849 or the next vulnerability affects your stack