CVE-2025-39823

KVM: x86: use array_index_nospec with indices that come from guest

State: Published
Severity: Not scored
Published: Sep 16, 2025
Updated: May 12, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: use array_index_nospec with indices that come from guest

min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48Affected 4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 31a0ad2f60cb4816e06218b63e695eb72ce74974Affected 4180bf1b655a791a0a6ef93a2ffffc762722c782 to before d51e381beed5e2f50f85f49f6c90e023754efa12Affected 4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985fAffected 4180bf1b655a791a0a6ef93a2ffffc762722c782 to before f49161646e03d107ce81a99c6ca5da682fe5fb69Affected 4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 67a05679621b7f721bdba37a5d18665d3aceb695Affected 4180bf1b655a791a0a6ef93a2ffffc762722c782 to before f57a4bd8d6cb5af05b8ac1be9098e249034639fbAffected 4180bf1b655a791a0a6ef93a2ffffc762722c782 to before c87bd4dd43a624109c3cc42d843138378a7f4548Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.4.298 through 5.4.Not affected 5.10.242 through 5.10.Not affected 5.15.191 through 5.15.Not affected 6.1.150 through 6.1.Not affected 6.6.104 through 6.6.Not affected 6.12.45 through 6.12.Not affected 6.16.5 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48Affected
4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 31a0ad2f60cb4816e06218b63e695eb72ce74974Affected
4180bf1b655a791a0a6ef93a2ffffc762722c782 to before d51e381beed5e2f50f85f49f6c90e023754efa12Affected
4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985fAffected
4180bf1b655a791a0a6ef93a2ffffc762722c782 to before f49161646e03d107ce81a99c6ca5da682fe5fb69Affected
4180bf1b655a791a0a6ef93a2ffffc762722c782 to before 67a05679621b7f721bdba37a5d18665d3aceb695Affected
4180bf1b655a791a0a6ef93a2ffffc762722c782 to before f57a4bd8d6cb5af05b8ac1be9098e249034639fbAffected
4180bf1b655a791a0a6ef93a2ffffc762722c782 to before c87bd4dd43a624109c3cc42d843138378a7f4548Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.4.298 through 5.4.*Not affected
5.10.242 through 5.10.*Not affected
5.15.191 through 5.15.*Not affected
6.1.150 through 6.1.*Not affected
6.6.104 through 6.6.*Not affected
6.12.45 through 6.12.*Not affected
6.16.5 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.