CVE-2025-39823

Vulnerability

Details

The Linux kernel's KVM subsystem for x86 contains a vulnerability where guest-controlled indices (min and dest_id) used in interrupt delivery are not protected against speculative execution side-channels. The fix adds array_index_nospec() after bounds checks to clamp these values, mitigating potential information disclosure via Spectre-type attacks [1].

Exploitation

An attacker with the ability to run code inside a guest VM can supply crafted values for these indices. While bounds checks are performed, speculative execution may bypass them, allowing an attacker to infer sensitive host kernel memory contents through timing or cache side-channels. No additional privileges are required beyond guest access.

Impact

Successful exploitation could lead to the disclosure of host kernel memory, potentially exposing cryptographic keys, passwords, or other sensitive data. The CVSS score of 7.8 (High) reflects the significant confidentiality impact.

Mitigation

The fix has been applied in the Linux kernel stable tree via commits [2][3][4]. Users should update to the latest kernel version. The Siemens advisory [1] lists this CVE among affected products, indicating that embedded systems using the kernel may also require patching.