CVE-2025-40136

In the Linux kernel's hisilicon/qm driver, interrupt vector 3 serves as an error interrupt for physical functions (PF) but is reserved for virtual functions (VF). The driver fails to register this reserved interrupt for VFs. Since interrupt allocation uses powers-of-two grouping, this unregistered interrupt is still included in the allocated set [1].

When the system enables GICv4 and a VF is passed through to a virtual machine, releasing the interrupt triggers a kernel warning in the GIC ITS code (vgic-its.c). The warning message indicates an invalid state transition, potentially leading to system instability or denial-of-service conditions [1].

The impact is limited to a kernel warning, which may escalate to a panic in certain configurations. Attackers with local access and the ability to manage VF passthrough could exploit this to cause disruptions. However, the vulnerability primarily manifests during normal operation under specific hardware and virtualization settings.

The fix registers the reserved interrupt for VFs with the IRQF_NO_AUTOEN flag, preventing the spurious warning. The patch has been accepted into the stable kernel tree [1]. Users should update to a kernel version containing commit 9228facb308157ac0bdd264b873187896f7a9c7a.