CVE-2025-23135
NoneCVSS
—
EPSS
0.2%
Published
Apr 16, 2025
CISA due date
—
Cloudanix analysis
A Linux kernel cleanup error on RISC-V machines can produce warnings and block restarting of virtualization software after it is stopped, sometimes requiring a reboot.
- Exploitation
- Local Privilege
- Attacker needs
- High Privilege
- Complexity
- Theoretical
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Other
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Improper ordering of architecture-specific cleanup functions during KVM module removal on RISC-V leads to percpu IRQs remaining enabled after aia_exit, triggering warnings in __free_percpu_irq and leaving IRQ state inconsistent so the module cannot be reinserted.
Why it matters to the business
On RISC-V systems administrators may see warnings and be unable to reload the KVM kernel module after unloading it, disrupting virtualization management and requiring reboots to recover module functionality.
How an attack unfolds
An attacker with root privileges triggers the flaw by unloading the kvm module; the premature aia_exit call before kvm_exit leaves percpu IRQs enabled, producing the warning and inconsistent state. No remote or unauthenticated exploitation is possible.
How to fix it
Apply the kernel fix containing commit 1edb2de48616b11ee05e9a65d74c70abcb6d9939. For Red Hat Enterprise Linux 9 systems update the listed gstreamer1-plugins-good packages to 1.22.1-3.el9_5 or newer.
How to confirm the fix worked
Confirm the patch commit is present in the running kernel; unload and reload the kvm module on RISC-V hardware and verify that no percpu IRQ warnings appear in dmesg.
Typical attack path
- Obtain root privileges on an affected RISC-V Linux host
- Execute rmmod kvm to unload the module
- Trigger the premature arch cleanup sequence
- Observe warning and blocked module re-insertion
How to detect it
Search kernel logs and dmesg for the strings 'percpu IRQ .* still enabled', '__free_percpu_irq', 'kvm_riscv_aia_exit', and 'cleanup_module' entries associated with kvm module removal.
- percpu IRQ .* still enabled on CPU
- kvm_riscv_aia_exit+0x40/0x42
- __free_percpu_irq+0xa2/0x150
- Modules linked in: kvm(-)
What your security team should do
- Apply the referenced kernel commit or package updates on all RISC-V systems
- Add kernel log monitoring for the specific IRQ warning strings
- Document and test KVM module reload procedures after patching
The record
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Teardown riscv specific bits after kvm_exit During a module removal, kvm_exit invokes arch specific disable call which disables AIA. However, we invoke aia_exit before kvm_exit resulting in the following warning. KVM kernel module can't be inserted afterwards due to inconsistent state of IRQ. [25469.031389] percpu IRQ 31 still enabled on CPU0! [25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 __free_percpu_irq+0xa2/0x150 [25469.031804] Modules linked in: kvm(-) [25469.031848] CPU: 3 UID: 0 PID: 943 Comm: rmmod Not tainted 6.14.0-rc5-06947-g91c763118f47-dirty #2 [25469.031905] Hardware name: riscv-virtio,qemu (DT) [25469.031928] epc : __free_percpu_irq+0xa2/0x150 [25469.031976] ra : __free_percpu_irq+0xa2/0x150 [25469.032197] epc : ffffffff8007db1e ra : ffffffff8007db1e sp : ff2000000088bd50 [25469.032241] gp : ffffffff8131cef8 tp : ff60000080b96400 t0 : ff2000000088baf8 [25469.032285] t1 : fffffffffffffffc t2 : 5249207570637265 s0 : ff2000000088bd90 [25469.032329] s1 : ff60000098b21080 a0 : 037d527a15eb4f00 a1 : 037d527a15eb4f00 [25469.032372] a2 : 0000000000000023 a3 : 0000000000000001 a4 : ffffffff8122dbf8 [25469.032410] a5 : 0000000000000fff a6 : 0000000000000000 a7 : ffffffff8122dc10 [25469.032448] s2 : ff60000080c22eb0 s3 : 0000000200000022 s4 : 000000000000001f [25469.032488] s5 : ff60000080c22e00 s6 : ffffffff80c351c0 s7 : 0000000000000000 [25469.032582] s8 : 0000000000000003 s9 : 000055556b7fb490 s10: 00007ffff0e12fa0 [25469.032621] s11: 00007ffff0e13e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7 [25469.032664] t5 : ffffffff81354ac8 t6 : ffffffff81354ac7 [25469.032698] status: 0000000200000100 badaddr: ffffffff8007db1e cause: 0000000000000003 [25469.032738] [<ffffffff8007db1e>] __free_percpu_irq+0xa2/0x150 [25469.032797] [<ffffffff8007dbfc>] free_percpu_irq+0x30/0x5e [25469.032856] [<ffffffff013a57dc>] kvm_riscv_aia_exit+0x40/0x42 [kvm] [25469.033947] [<ffffffff013b4e82>] cleanup_module+0x10/0x32 [kvm] [25469.035300] [<ffffffff8009b150>] __riscv_sys_delete_module+0x18e/0x1fc [25469.035374] [<ffffffff8000c1ca>] syscall_handler+0x3a/0x46 [25469.035456] [<ffffffff809ec9a4>] do_trap_ecall_u+0x72/0x134 [25469.035536] [<ffffffff809f5e18>] handle_exception+0x148/0x156 Invoke aia_exit and other arch specific cleanup functions after kvm_exit so that disable gets a chance to be called first before exit.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | hyperv-daemons-6.12 | 0 | 6.12.57-r0 |
| Chainguard | linux-aws-6.12-boot-installed | 0 | 6.12.57-r0 |
| Chainguard | linux-aws-6.12-fips-boot-installed | 0 | 6.12.57-r0 |
| Chainguard | linux-aws-6.12-headers | 0 | 6.12.57-r1 |
| Chainguard | linux-aws-6.12-modules | 0 | 6.12.57-r0 |
| Chainguard | linux-azure-6.12-boot-installed | 0 | 6.12.57-r0 |
| Chainguard | linux-azure-6.12-fips-boot-installed | 0 | 6.12.57-r0 |
| Chainguard | linux-azure-6.12-headers | 0 | 6.12.57-r1 |
| Chainguard | linux-azure-6.12-modules | 0 | 6.12.57-r0 |
| Chainguard | linux-gcp-6.12-boot-installed | 0 | 6.12.57-r0 |
| Chainguard | linux-gcp-6.12-fips-boot-installed | 0 | 6.12.57-r0 |
| Chainguard | linux-gcp-6.12-headers | 0 | 6.12.57-r1 |
| Chainguard | linux-gcp-6.12-modules | 0 | 6.12.57-r1 |
| Chainguard | linux-qemu-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-qemu-6.12-modules | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12 | 0 | 6.12.67-r0 |
| Chainguard | linux-vmware-6.12-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-fips-boot-installed | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-headers | 0 | 6.12.63-r0 |
| Chainguard | linux-vmware-6.12-modules | 0 | 6.12.63-r0 |
| Debian:13 | linux | 0 | No fix |
| Debian:14 | linux | 0 | 6.16.3-1 |
| Linux | Kernel | 6.4.0 | 6.13.11 |
Related vulnerabilities
- CVE-2025-39910 In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc, mm/kasan… Also affects hyperv-daemons-6.12
- CVE-2025-39925 can: j1939: implement NETDEV_UNREGISTER notification handler Also affects hyperv-daemons-6.12
- CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Also affects hyperv-daemons-6.12
- CVE-2025-39862 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915… Also affects hyperv-daemons-6.12
- CVE-2025-39859 In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: fix… Also affects hyperv-daemons-6.12
- CVE-2025-39834 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39830 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix… Also affects hyperv-daemons-6.12
- CVE-2025-39833 In the Linux kernel, the following vulnerability has been resolved: mISDN: hfcpci: Fix… Also affects hyperv-daemons-6.12