In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Reset IRTE to host control if new route isn't postable
Restore an IRTE back to host control (remapped or posted MSI mode) if the new GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing type. Updating the IRTE if and only if the new GSI is an MSI results in KVM leaving an IRTE posting to a vCPU.
The dangling IRTE can result in interrupts being incorrectly delivered to the guest, and in the worst case scenario can result in use-after-free, e.g. if the VM is torn down, but the underlying host IRQ isn't freed.
[
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/vmx/posted_intr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"10571137190573783128089182469744779395",
"89976711223922529853994408508227778636",
"238761231728495400267370697487516375113",
"313996368581358746156800873267252393547",
"15596452590260594546941012488884500265",
"330040894121793511016543835387451884758",
"247281838087816700861348200764262432761",
"331028498855980943076759849849538221885",
"58840933490198821130412245040623854229",
"276814656957696648014882847896742364077",
"60786851674166283441283501422399727326",
"277107994666806789893721946635993243547",
"126068649002178521940650837656706889905",
"191257361138351988320454599915753452996",
"80228237477769382210522790039782885676",
"315963551908728206308098356168328632994",
"274579756952630351345096632520823890060",
"325347830443745811908645595771574194303",
"115922496362716546526308501824642368224",
"130562904125180472448869825574272212099",
"221485047756073565595221372897156649848",
"222950330237790771005076548828624278054",
"263269117792479013914833969952928227209",
"56730294046159068018268867489410988650",
"46585351343699491610361950369955603852",
"113807467056820830241861244286066075621",
"205973863417073037120717263142129734596"
]
},
"id": "CVE-2025-37885-1ed5fe3c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5de7ac74f69603ad803c524b840bffd36368fc3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/svm/avic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"10571137190573783128089182469744779395",
"105257471697626655305078752453377890930",
"40580905337724776340490991105464404074",
"291598180482038728261698467930980026500",
"29887666920994477735838298470918411583",
"19702995138577149428757184394928597874",
"148641658293350536073082116178246315143",
"96516449437518329368233943817385792999",
"83466215780811469581274655688653028560",
"336269597662324664720624932576013676567",
"32842110148645022218958905059355393189",
"104082324022833814696133867066048894165",
"233569924454521483599022651870346479707",
"142516985898371170579063366377114155813",
"53497496040366169352129961433455118320",
"275699437520853543544181686031133736624",
"54490468174622856392777170786931081655",
"105569363317205539157017744720989239992",
"211338160586090730266726446087945651895",
"90361639754950184648545131098661088543",
"67346349302359345304652331796317162186",
"163220482457264572402507044424510529825",
"46585351343699491610361950369955603852",
"113807467056820830241861244286066075621",
"205973863417073037120717263142129734596",
"34933033406236862529312770317402975725"
]
},
"id": "CVE-2025-37885-23251fe3",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3066ec21d1a33896125747f68638725f456308db",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/svm/avic.c",
"function": "avic_pi_update_irte"
},
"digest": {
"function_hash": "316818655468534888479189557452495790827",
"length": 1757.0
},
"id": "CVE-2025-37885-677b53c1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3066ec21d1a33896125747f68638725f456308db",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/vmx/posted_intr.c",
"function": "vmx_pi_update_irte"
},
"digest": {
"function_hash": "236539721001415908140627160599760319588",
"length": 1318.0
},
"id": "CVE-2025-37885-7120ac06",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3066ec21d1a33896125747f68638725f456308db",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/svm/avic.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"10571137190573783128089182469744779395",
"105257471697626655305078752453377890930",
"40580905337724776340490991105464404074",
"291598180482038728261698467930980026500",
"29887666920994477735838298470918411583",
"19702995138577149428757184394928597874",
"148641658293350536073082116178246315143",
"96516449437518329368233943817385792999",
"83466215780811469581274655688653028560",
"336269597662324664720624932576013676567",
"32842110148645022218958905059355393189",
"104082324022833814696133867066048894165",
"233569924454521483599022651870346479707",
"142516985898371170579063366377114155813",
"53497496040366169352129961433455118320",
"275699437520853543544181686031133736624",
"54490468174622856392777170786931081655",
"105569363317205539157017744720989239992",
"211338160586090730266726446087945651895",
"90361639754950184648545131098661088543",
"67346349302359345304652331796317162186",
"163220482457264572402507044424510529825",
"46585351343699491610361950369955603852",
"113807467056820830241861244286066075621",
"205973863417073037120717263142129734596",
"34933033406236862529312770317402975725"
]
},
"id": "CVE-2025-37885-7f70be4c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5de7ac74f69603ad803c524b840bffd36368fc3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/svm/avic.c",
"function": "avic_pi_update_irte"
},
"digest": {
"function_hash": "316818655468534888479189557452495790827",
"length": 1757.0
},
"id": "CVE-2025-37885-a2e29025",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5de7ac74f69603ad803c524b840bffd36368fc3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/vmx/posted_intr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"10571137190573783128089182469744779395",
"89976711223922529853994408508227778636",
"238761231728495400267370697487516375113",
"313996368581358746156800873267252393547",
"15596452590260594546941012488884500265",
"330040894121793511016543835387451884758",
"247281838087816700861348200764262432761",
"331028498855980943076759849849538221885",
"58840933490198821130412245040623854229",
"276814656957696648014882847896742364077",
"60786851674166283441283501422399727326",
"277107994666806789893721946635993243547",
"126068649002178521940650837656706889905",
"191257361138351988320454599915753452996",
"80228237477769382210522790039782885676",
"315963551908728206308098356168328632994",
"274579756952630351345096632520823890060",
"325347830443745811908645595771574194303",
"115922496362716546526308501824642368224",
"130562904125180472448869825574272212099",
"221485047756073565595221372897156649848",
"222950330237790771005076548828624278054",
"263269117792479013914833969952928227209",
"56730294046159068018268867489410988650",
"46585351343699491610361950369955603852",
"113807467056820830241861244286066075621",
"205973863417073037120717263142129734596"
]
},
"id": "CVE-2025-37885-cf9855a6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3066ec21d1a33896125747f68638725f456308db",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "arch/x86/kvm/vmx/posted_intr.c",
"function": "vmx_pi_update_irte"
},
"digest": {
"function_hash": "236539721001415908140627160599760319588",
"length": 1318.0
},
"id": "CVE-2025-37885-dfa03af0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5de7ac74f69603ad803c524b840bffd36368fc3",
"signature_version": "v1"
}
]