{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-21740", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.757Z", "datePublished": "2025-02-27T02:12:15.222Z", "dateUpdated": "2025-02-27T02:12:15.222Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-02-27T02:12:15.222Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking\n\nWhen waking a VM's NX huge page recovery thread, ensure the thread is\nactually alive before trying to wake it. Now that the thread is spawned\non-demand during KVM_RUN, a VM without a recovery thread is reachable via\nthe related module params.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000040\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:vhost_task_wake+0x5/0x10\n Call Trace:\n <TASK>\n set_nx_huge_pages+0xcc/0x1e0 [kvm]\n param_attr_store+0x8a/0xd0\n module_attr_store+0x1a/0x30\n kernfs_fop_write_iter+0x12f/0x1e0\n vfs_write+0x233/0x3e0\n ksys_write+0x60/0xd0\n do_syscall_64+0x5b/0x160\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f3b52710104\n </TASK>\n Modules linked in: kvm_intel kvm\n CR2: 0000000000000040"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/mmu/mmu.c"], "versions": [{"version": "27f651d28feed4b1bc6d8256c74d92f4d6302e96", "lessThan": "2b3928b7c896e5a9fb6b1373924adafe8e01a0c6", "status": "affected", "versionType": "git"}, {"version": "dd96719c4add49472d740a541fdec5abb7ea270b", "lessThan": "974f85f1f7eb7dc7fce0988046e06eeccab576a7", "status": "affected", "versionType": "git"}, {"version": "931656b9e2ff7029aee0b36e17780621948a6ac1", "lessThan": "43fb96ae78551d7bfa4ecca956b258f085d67c40", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kvm/mmu/mmu.c"], "versions": [{"version": "6.14-rc1", "status": "affected"}, {"version": "0", "lessThan": "6.14-rc1", "status": "unaffected", "versionType": "semver"}, {"version": "6.14-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/2b3928b7c896e5a9fb6b1373924adafe8e01a0c6"}, {"url": "https://git.kernel.org/stable/c/974f85f1f7eb7dc7fce0988046e06eeccab576a7"}, {"url": "https://git.kernel.org/stable/c/43fb96ae78551d7bfa4ecca956b258f085d67c40"}], "title": "KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking", "x_generator": {"engine": "bippy-5f407fcff5a0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking\n\nWhen waking a VM's NX huge page recovery thread, ensure the thread is\nactually alive before trying to wake it. Now that the thread is spawned\non-demand during KVM_RUN, a VM without a recovery thread is reachable via\nthe related module params.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000040\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:vhost_task_wake+0x5/0x10\n Call Trace:\n <TASK>\n set_nx_huge_pages+0xcc/0x1e0 [kvm]\n param_attr_store+0x8a/0xd0\n module_attr_store+0x1a/0x30\n kernfs_fop_write_iter+0x12f/0x1e0\n vfs_write+0x233/0x3e0\n ksys_write+0x60/0xd0\n do_syscall_64+0x5b/0x160\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f3b52710104\n </TASK>\n Modules linked in: kvm_intel kvm\n CR2: 0000000000000040"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: x86/mmu: Aseg\u00farese de que el subproceso de recuperaci\u00f3n de p\u00e1ginas enormes de NX est\u00e9 activo antes de reactivarlo. Al reactivar el subproceso de recuperaci\u00f3n de p\u00e1ginas enormes de NX de una m\u00e1quina virtual, aseg\u00farese de que el subproceso est\u00e9 realmente activo antes de intentar reactivarlo. Ahora que el subproceso se genera a pedido durante KVM_RUN, se puede acceder a una m\u00e1quina virtual sin un subproceso de recuperaci\u00f3n a trav\u00e9s de los par\u00e1metros del m\u00f3dulo relacionado. ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000040 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:vhost_task_wake+0x5/0x10 Rastreo de llamadas: set_nx_huge_pages+0xcc/0x1e0 [kvm] param_attr_store+0x8a/0xd0 module_attr_store+0x1a/0x30 kernfs_fop_write_iter+0x12f/0x1e0 vfs_write+0x233/0x3e0 ksys_write+0x60/0xd0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f3b52710104 M\u00f3dulos vinculados en: kvm_intel kvm CR2: 000000000000040"}], "id": "CVE-2025-21740", "lastModified": "2025-03-06T12:21:35.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-27T03:15:14.630", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b3928b7c896e5a9fb6b1373924adafe8e01a0c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/43fb96ae78551d7bfa4ecca956b258f085d67c40"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/974f85f1f7eb7dc7fce0988046e06eeccab576a7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking", "id": "2348628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348628"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking\nWhen waking a VM's NX huge page recovery thread, ensure the thread is\nactually alive before trying to wake it. Now that the thread is spawned\non-demand during KVM_RUN, a VM without a recovery thread is reachable via\nthe related module params.\nBUG: kernel NULL pointer dereference, address: 0000000000000040\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\nRIP: 0010:vhost_task_wake+0x5/0x10\nCall Trace:\n<TASK>\nset_nx_huge_pages+0xcc/0x1e0 [kvm]\nparam_attr_store+0x8a/0xd0\nmodule_attr_store+0x1a/0x30\nkernfs_fop_write_iter+0x12f/0x1e0\nvfs_write+0x233/0x3e0\nksys_write+0x60/0xd0\ndo_syscall_64+0x5b/0x160\nentry_SYSCALL_64_after_hwframe+0x4b/0x53\nRIP: 0033:0x7f3b52710104\n</TASK>\nModules linked in: kvm_intel kvm\nCR2: 0000000000000040"], "name": "CVE-2025-21740", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21740\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21740\nhttps://lore.kernel.org/linux-cve-announce/2025022659-CVE-2025-21740-083e@gregkh/T"], "threat_severity": "Moderate"}