CVE-2025-21779

What it actually does

NULL-pointer dereference in KVM x86 hypercall handling path when SEND_IPI or SEND_IPI_EX Hyper-V hypercalls are invoked on a vCPU whose local APIC is emulated in userspace rather than in-kernel.

Why it matters to the business

Guest-triggered kernel panic or denial of service on Linux hosts exposing Hyper-V enlightenments to VMs; in shared or cloud environments this can disrupt multiple workloads and require host reboots.

How an attack unfolds

An attacker with code execution inside a guest VM issues a SEND_IPI hypercall; because the in-kernel APIC check was missing, execution reaches __apic_accept_irq with a NULL APIC structure, triggering the dereference and kernel crash. Related kernel privilege-escalation techniques seen in other Linux KVM CVEs could be adapted if the dereference is turned into a write primitive.

How to fix it

Apply the upstream fix (commit 61224533f2b61e252b03e214195d27d64b22989a) or any stable kernel branch containing it; ensure KVM is built with in-kernel local APIC support when Hyper-V enlightenments are advertised.

How to confirm the fix worked

Confirm the running kernel contains commit 61224533f2b61e252b03e214195d27d64b22989a or later; test that SEND_IPI hypercalls are rejected with -KVM_ENOSYS when the local APIC is not in-kernel.

Typical attack path

1. Obtain code execution inside guest VM with Hyper-V enlightenments enabled
2. Invoke SEND_IPI or SEND_IPI_EX hypercall from guest userspace or kernel
3. KVM hypercall dispatcher routes to kvm_hv_send_ipi without APIC validation
4. NULL dereference occurs in APIC interrupt delivery path leading to panic

How to detect it

Search kernel logs for kasan_report or __apic_accept_irq stack traces immediately preceding a guest hypercall; correlate with KVM hypercall exit reasons indicating SEND_IPI usage.

What your security team should do

• Prioritize patching all Linux hosts that expose Hyper-V enlightenments within the next maintenance window
• Disable Hyper-V CPUID bits for guests that do not require them until patches are applied
• Monitor for guest-initiated hypercalls that previously would have reached the vulnerable path