What’s Vulnerable › Vulnerabilities

CVE-2025-38366: LoongArch: KVM: Check validity of "num_cpu" from user space

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-25 · updated 2026-07-30

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check validity of "num_cpu" from user space The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about irqchip EIOINTC, here add validation about cpu number to avoid array pointer overflow.

Affected products

• Linux kernel: from 6.13 before 6.15.5; 6.16-rc1, 6.16-rc2, 6.16-rc3 — fixed in 6.15.5

How to fix

Upgrade to a fixed version: Linux kernel 6.15.5. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/a3293b4078ee93174f70f36d3ab7618554ce6ab6
• https://git.kernel.org/stable/c/cc8d5b209e09d3b52bca1ffe00045876842d96ae

Get alerted when CVE-2025-38366 or the next vulnerability affects your stack