High 7.8Published Sep 16, 2025

CVE-2025-39823KVM: x86: use array_index_nospec with indices that come from guest

Updated under an hour ago (Oct 27, 2026, 7:50 AM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4180bf1b655a791a0a6ef93a2ffffc762722c782 before 72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48; 4180bf1b655a791a0a6ef93a2ffffc762722c782 builds before 31a0ad2f60cb4816e06218b63e695eb72ce74974; from 4180bf1b655a791a0a6ef93a2ffffc762722c782 before d51e381beed5e2f50f85f49f6c90e023754efa12; 4180bf1b655a791a0a6ef93a2ffffc762722c782 builds before 33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f; from 4180bf1b655a791a0a6ef93a2ffffc762722c782 before f49161646e03d107ce81a99c6ca5da682fe5fb69; 4180bf1b655a791a0a6ef93a2ffffc762722c782 builds before 67a05679621b7f721bdba37a5d18665d3aceb695; from 4180bf1b655a791a0a6ef93a2ffffc762722c782 before f57a4bd8d6cb5af05b8ac1be9098e249034639fb; from 4180bf1b655a791a0a6ef93a2ffffc762722c782 before c87bd4dd43a624109c3cc42d843138378a7f4548	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.19 before 5.4.298; from 5.5 before 5.10.242; from 5.11 before 5.15.191; from 5.16 before 6.1.150; from 6.2 before 6.6.104; from 6.7 before 6.12.45; from 6.13 before 6.16.5; 6.17; and 2 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48	patch
https://git.kernel.org/stable/c/31a0ad2f60cb4816e06218b63e695eb72ce74974	patch
https://git.kernel.org/stable/c/d51e381beed5e2f50f85f49f6c90e023754efa12	patch
https://git.kernel.org/stable/c/33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f	patch
https://git.kernel.org/stable/c/f49161646e03d107ce81a99c6ca5da682fe5fb69	patch
https://git.kernel.org/stable/c/67a05679621b7f721bdba37a5d18665d3aceb695	patch
https://git.kernel.org/stable/c/f57a4bd8d6cb5af05b8ac1be9098e249034639fb	patch
https://git.kernel.org/stable/c/c87bd4dd43a624109c3cc42d843138378a7f4548	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.