Medium 5.5Published Feb 26, 2025

CVE-2025-21779KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel

Updated under an hour ago (Oct 26, 2026, 3:00 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID. Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC: dump_stack+0xbe/0xfd __kasan_report.cold+0x34/0x84 kasan_report+0x3a/0x50 __apic_accept_irq+0x3a/0x5c0 kvm_hv_send_ipi.isra.0+0x34e/0x820 kvm_hv_hypercall+0x8d9/0x9d0 kvm_emulate_hypercall+0x506/0x7e0 __vmx_handle_exit+0x283/0xb60 vmx_handle_exit+0x1d/0xd0 vcpu_enter_guest+0x16b0/0x24c0 vcpu_run+0xc0/0x550 kvm_arch_vcpu_ioctl_run+0x170/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscal1_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 214ff83d4473a7757fa18a64dc7efe3b0e158486 before 61224533f2b61e252b03e214195d27d64b22989a; 214ff83d4473a7757fa18a64dc7efe3b0e158486 builds before 45fa526b0f5a34492ed0536c3cdf88b78380e4de; from 214ff83d4473a7757fa18a64dc7efe3b0e158486 before 5393cf22312418262679eaadb130d608c75fe690; from 214ff83d4473a7757fa18a64dc7efe3b0e158486 before 874ff13c73c45ecb38cb82191e8c1d523f0dc81b; from 214ff83d4473a7757fa18a64dc7efe3b0e158486 before aca8be4403fb90db7adaf63830e27ebe787a76e8; from 214ff83d4473a7757fa18a64dc7efe3b0e158486 before ca29f58ca374c40a0e69c5306fc5c940a0069074; from 214ff83d4473a7757fa18a64dc7efe3b0e158486 before a8de7f100bb5989d9c3627d3a223ee1c863f3b69	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.20 before 6.1.129; from 6.2 before 6.6.79; from 6.7 before 6.12.16; from 6.13 before 6.13.4; 6.14; 6.14	NVD

References

References

https://git.kernel.org/stable/c/61224533f2b61e252b03e214195d27d64b22989a
https://git.kernel.org/stable/c/45fa526b0f5a34492ed0536c3cdf88b78380e4de
https://git.kernel.org/stable/c/5393cf22312418262679eaadb130d608c75fe690	mailing-list, patch
https://git.kernel.org/stable/c/874ff13c73c45ecb38cb82191e8c1d523f0dc81b	mailing-list, patch
https://git.kernel.org/stable/c/aca8be4403fb90db7adaf63830e27ebe787a76e8	mailing-list, patch
https://git.kernel.org/stable/c/ca29f58ca374c40a0e69c5306fc5c940a0069074	mailing-list, patch
https://git.kernel.org/stable/c/a8de7f100bb5989d9c3627d3a223ee1c863f3b69	mailing-list, patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.