CVE-2025-40300

x86/vmscape: Add conditional IBPB mitigation

State: Published
Severity: Not scored
Published: Sep 11, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/vmscape: Add conditional IBPB mitigation

VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit.

Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB.

This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace.

The intent is to integrate and optimize these cases post-embargo.

[ dhansen: elaborate on suboptimal IBPB solution ]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	15d45071523d89b3fb7372e2135fbd72f6af9506 to before ac60717f9a8d21c58617d0b34274babf24135835Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before c08192b5d6730a914dee6175bc71092ee6a65f14Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before d5490dfa35427a2967e00a4c7a1b95fdbc8ede34Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6eAffected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 15006289e5c38b2a830e1fba221977a27598176cAffected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 893387c18612bb452336a5881da0d015a7e8f4a2Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before f866eef8d1c65504d30923c3f14082ad294d0e6dAffected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 34e5667041050711a947e260fc9ebebe08bddee5Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before d7ddc93392e4a7ffcccc86edf6ef3e64c778db52Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 459274c77b37ac63b78c928b4b4e748d1f9d05c8Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 510603f504796c3535f67f55fb0b124a303b44c8Affected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 9c23a90648e831d611152ac08dbcd1283d405e7fAffected 15d45071523d89b3fb7372e2135fbd72f6af9506 to before 2f8f173413f1cbf52660d04df92d0069c4306d25Affected c51f1e5f57cca88d8d5894b6fad1638f643a99d0Affected 4b3870c343a82cd2df7192cc5149c87205dcc611Affected 3.16.57 to before 3.17Affected 4.4.168 to before 4.5Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.244 through 5.10.Not affected 5.15.193 through 5.15.Not affected 6.1.152 through 6.1.Not affected 6.6.106 through 6.6.Not affected 6.12.47 through 6.12.Not affected 6.16.7 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

15d45071523d89b3fb7372e2135fbd72f6af9506 to before ac60717f9a8d21c58617d0b34274babf24135835Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before c08192b5d6730a914dee6175bc71092ee6a65f14Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before d5490dfa35427a2967e00a4c7a1b95fdbc8ede34Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6eAffected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 15006289e5c38b2a830e1fba221977a27598176cAffected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 893387c18612bb452336a5881da0d015a7e8f4a2Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before f866eef8d1c65504d30923c3f14082ad294d0e6dAffected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 34e5667041050711a947e260fc9ebebe08bddee5Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before d7ddc93392e4a7ffcccc86edf6ef3e64c778db52Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 459274c77b37ac63b78c928b4b4e748d1f9d05c8Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 510603f504796c3535f67f55fb0b124a303b44c8Affected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 9c23a90648e831d611152ac08dbcd1283d405e7fAffected
15d45071523d89b3fb7372e2135fbd72f6af9506 to before 2f8f173413f1cbf52660d04df92d0069c4306d25Affected
c51f1e5f57cca88d8d5894b6fad1638f643a99d0Affected
4b3870c343a82cd2df7192cc5149c87205dcc611Affected
3.16.57 to before 3.17Affected
4.4.168 to before 4.5Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.244 through 5.10.*Not affected
5.15.193 through 5.15.*Not affected
6.1.152 through 6.1.*Not affected
6.6.106 through 6.6.*Not affected
6.12.47 through 6.12.*Not affected
6.16.7 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.