Linux kernel (virt/kvm): Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if the

CVSS 7.8CVE-2025-40274Kernel, userspace & hypervisorcurated

Impact

Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if the memslot is freed first the release path writes eight bytes through a freed pointer. syzbot and KASAN confirm the slab use-after-free write in host kernel memory - a straightforward kernel corruption primitive on nodes that run confidential VMs.

Who can reach it

Reached through KVM ioctls on the VM fd (memslot deletion racing guest_memfd close), not from inside a guest. Under a trusted-VMM model this is not a tenant path; it becomes one wherever untrusted local users or tenant-controlled VMM processes hold /dev/kvm, where it is a local privilege-escalation primitive. Only nodes with guest_memfd in use (SEV-SNP / TDX confidential VMs) exercise this code.

What to do

Update to a stable kernel carrying the linked fix (no fixed release enumerated; take the branch containing commit ae431059e75d). Interim control: keep /dev/kvm out of tenant containers and restricted to the operator's VMM account.

References

https://git.kernel.org/stable/c/ae431059e75d36170a5ae6b44cc4d06d43613215 https://git.kernel.org/stable/c/393893693a523e053f84d69320d090b93503f79f https://nvd.nist.gov/vuln/detail/CVE-2025-40274

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.