CVE-2025-40160

xen/events: Return -EEXIST for bound VIRQs

State: Published
Severity: Not scored
Published: Nov 12, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

xen/events: Return -EEXIST for bound VIRQs

Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards.

Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON().

A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before 7e19b3643855d4b63442bd20e8bb811e1a75998eAffected 62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before 612ef6056855c0aacb9b25d1d853c435754483f7Affected 62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before a1e7f07ae6b594f1ba5be46c6125b43bc505c5aaAffected 62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before f81db055a793eca9d05f79658ff62adafb41d664Affected 62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before 07ce121d93a5e5fb2440a24da3dbf408fcee978eAffected
LinuxLinux	3.2Affected before 3.2Not affected 6.1.191 through 6.1.Not affected 6.6.113 through 6.6.Not affected 6.12.54 through 6.12.Not affected 6.17.4 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before 7e19b3643855d4b63442bd20e8bb811e1a75998eAffected
62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before 612ef6056855c0aacb9b25d1d853c435754483f7Affected
62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before a1e7f07ae6b594f1ba5be46c6125b43bc505c5aaAffected
62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before f81db055a793eca9d05f79658ff62adafb41d664Affected
62cc5fc7b2e0218144e162afb8191db9b924b5e6 to before 07ce121d93a5e5fb2440a24da3dbf408fcee978eAffected

LinuxLinux

3.2Affected
before 3.2Not affected
6.1.191 through 6.1.*Not affected
6.6.113 through 6.6.*Not affected
6.12.54 through 6.12.*Not affected
6.17.4 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.