In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
Advertise support for Hyper-V's SENDIPI and SENDIPIEX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVMCAPHYPERVENFORCE_CPUID.
Rejecting SENDIPI and SENDIPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC:
dumpstack+0xbe/0xfd _kasanreport.cold+0x34/0x84 kasanreport+0x3a/0x50 _apicacceptirq+0x3a/0x5c0 kvmhvsendipi.isra.0+0x34e/0x820 kvmhvhypercall+0x8d9/0x9d0 kvmemulatehypercall+0x506/0x7e0 _vmxhandleexit+0x283/0xb60 vmxhandleexit+0x1d/0xd0 vcpuenterguest+0x16b0/0x24c0 vcpurun+0xc0/0x550 kvmarchvcpuioctlrun+0x170/0x6d0 kvmvcpuioctl+0x413/0xb20 _sesysioctl+0x111/0x160 dosyscal164+0x30/0x40 entrySYSCALL64after_hwframe+0x67/0xd1
Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC.
[
{
"digest": {
"length": 2104.0,
"function_hash": "250529280568483346723103313185293900708"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fa526b0f5a34492ed0536c3cdf88b78380e4de",
"target": {
"function": "kvm_hv_send_ipi",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-033e6cc9",
"signature_type": "Function"
},
{
"digest": {
"length": 1560.0,
"function_hash": "262045185263376805358009012341544562803"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61224533f2b61e252b03e214195d27d64b22989a",
"target": {
"function": "kvm_hv_send_ipi",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-0350186a",
"signature_type": "Function"
},
{
"digest": {
"length": 3765.0,
"function_hash": "44999600873629135732558208972340864858"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8de7f100bb5989d9c3627d3a223ee1c863f3b69",
"target": {
"function": "kvm_get_hv_cpuid",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-05977c1f",
"signature_type": "Function"
},
{
"digest": {
"length": 3765.0,
"function_hash": "44999600873629135732558208972340864858"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca29f58ca374c40a0e69c5306fc5c940a0069074",
"target": {
"function": "kvm_get_hv_cpuid",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-13d7c7f8",
"signature_type": "Function"
},
{
"digest": {
"length": 1792.0,
"function_hash": "159504616194763773986818835733760056300"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aca8be4403fb90db7adaf63830e27ebe787a76e8",
"target": {
"function": "kvm_hv_send_ipi",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-15f779a8",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"62474532908276933541271867619717019353",
"44630892371399263342491447873506798746",
"25032272470494635130666034852581884263",
"241022717465652732240443163596310533239",
"163993415773975702401586283290299524598",
"229436150539413919822146883374078451179",
"204833089216807630055363015010610718822"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8de7f100bb5989d9c3627d3a223ee1c863f3b69",
"target": {
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-1adf780c",
"signature_type": "Line"
},
{
"digest": {
"length": 1792.0,
"function_hash": "159504616194763773986818835733760056300"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@874ff13c73c45ecb38cb82191e8c1d523f0dc81b",
"target": {
"function": "kvm_hv_send_ipi",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-2e997095",
"signature_type": "Function"
},
{
"digest": {
"length": 1797.0,
"function_hash": "331688053899701027914134947997435636103"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5393cf22312418262679eaadb130d608c75fe690",
"target": {
"function": "kvm_hv_send_ipi",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-334dc525",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"232440745897500979903336383206275592163",
"21245892713280803437951004465232621771",
"298219673347763810547087108408763883426",
"241022717465652732240443163596310533239",
"163993415773975702401586283290299524598",
"229436150539413919822146883374078451179",
"204833089216807630055363015010610718822"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fa526b0f5a34492ed0536c3cdf88b78380e4de",
"target": {
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-49f049b7",
"signature_type": "Line"
},
{
"digest": {
"length": 1792.0,
"function_hash": "159504616194763773986818835733760056300"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca29f58ca374c40a0e69c5306fc5c940a0069074",
"target": {
"function": "kvm_hv_send_ipi",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-4bc8efd3",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"285444404138921442138614081833359714089",
"44630892371399263342491447873506798746",
"25032272470494635130666034852581884263",
"241022717465652732240443163596310533239",
"163993415773975702401586283290299524598",
"229436150539413919822146883374078451179",
"204833089216807630055363015010610718822"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5393cf22312418262679eaadb130d608c75fe690",
"target": {
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-6d1b372a",
"signature_type": "Line"
},
{
"digest": {
"length": 3765.0,
"function_hash": "44999600873629135732558208972340864858"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@874ff13c73c45ecb38cb82191e8c1d523f0dc81b",
"target": {
"function": "kvm_get_hv_cpuid",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-7aafc1ec",
"signature_type": "Function"
},
{
"digest": {
"length": 3435.0,
"function_hash": "127150635483492443431537693688486676220"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61224533f2b61e252b03e214195d27d64b22989a",
"target": {
"function": "kvm_vcpu_ioctl_get_hv_cpuid",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-84199cd5",
"signature_type": "Function"
},
{
"digest": {
"length": 1792.0,
"function_hash": "159504616194763773986818835733760056300"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8de7f100bb5989d9c3627d3a223ee1c863f3b69",
"target": {
"function": "kvm_hv_send_ipi",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-8715386e",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"62474532908276933541271867619717019353",
"44630892371399263342491447873506798746",
"25032272470494635130666034852581884263",
"241022717465652732240443163596310533239",
"163993415773975702401586283290299524598",
"229436150539413919822146883374078451179",
"204833089216807630055363015010610718822"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@874ff13c73c45ecb38cb82191e8c1d523f0dc81b",
"target": {
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-87c802b3",
"signature_type": "Line"
},
{
"digest": {
"length": 3765.0,
"function_hash": "44999600873629135732558208972340864858"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aca8be4403fb90db7adaf63830e27ebe787a76e8",
"target": {
"function": "kvm_get_hv_cpuid",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-8d236ca8",
"signature_type": "Function"
},
{
"digest": {
"length": 3515.0,
"function_hash": "75530415445005449688409024803926449782"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fa526b0f5a34492ed0536c3cdf88b78380e4de",
"target": {
"function": "kvm_get_hv_cpuid",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-a2a7bc8b",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"62474532908276933541271867619717019353",
"44630892371399263342491447873506798746",
"25032272470494635130666034852581884263",
"241022717465652732240443163596310533239",
"163993415773975702401586283290299524598",
"229436150539413919822146883374078451179",
"204833089216807630055363015010610718822"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aca8be4403fb90db7adaf63830e27ebe787a76e8",
"target": {
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-a4c91be5",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"106386205288557508328506595093866624567",
"77390309712877645260535249029608998227",
"276803285184510305441081543421387626259",
"241022717465652732240443163596310533239",
"163993415773975702401586283290299524598",
"229436150539413919822146883374078451179",
"204833089216807630055363015010610718822"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61224533f2b61e252b03e214195d27d64b22989a",
"target": {
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-cbf90776",
"signature_type": "Line"
},
{
"digest": {
"length": 3588.0,
"function_hash": "140747867985521183115956441299325105184"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5393cf22312418262679eaadb130d608c75fe690",
"target": {
"function": "kvm_get_hv_cpuid",
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-d870c3b4",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"62474532908276933541271867619717019353",
"44630892371399263342491447873506798746",
"25032272470494635130666034852581884263",
"241022717465652732240443163596310533239",
"163993415773975702401586283290299524598",
"229436150539413919822146883374078451179",
"204833089216807630055363015010610718822"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca29f58ca374c40a0e69c5306fc5c940a0069074",
"target": {
"file": "arch/x86/kvm/hyperv.c"
},
"id": "CVE-2025-21779-de7d9a2b",
"signature_type": "Line"
}
]