CVE-2025-40160
In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards. Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON(). A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.
Affected versions
Linux kernel versions
3.2
and later are affected. Fixed in
6.6.113,
6.12.54,
6.17.4,
6.18
and their respective stable series.
References
The following references provide additional information about CVE-2025-40160 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/07ce121d93a5e5fb2440a24da3dbf408fcee978e
-
PatchKernel patch commithttps://git.kernel.org/stable/c/612ef6056855c0aacb9b25d1d853c435754483f7
-
PatchKernel patch commithttps://git.kernel.org/stable/c/a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa
Frequently asked questions
-
What is CVE-2025-40160?
CVE-2025-40160 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.2 onward and has been patched in 6.6.113, 6.12.54, 6.17.4 and others. CVE-2025-40160 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-40160?
Yes — CVE-2025-40160 has been patched. Fixed versions include 6.6.113, 6.12.54, 6.17.4 and others. If you are running Linux kernel 3.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-40160 actively exploited?
No — CVE-2025-40160 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.