CVE-2025-39815

What it actually does

Allows a stack buffer overflow in the RISC-V KVM module when loading vlenb values from userspace, as the code does not validate that the input size fits within an xlen-bit stack buffer before copying up to 2048 bits.

Why it matters to the business

Can lead to system instability, crashes, or potential privilege escalation in virtualized RISC-V environments, impacting the reliability and security of Linux-based hypervisors and guest VMs.

How an attack unfolds

An attacker with the ability to interact with the KVM interface on a RISC-V system supplies an oversized vlenb load request from userspace, causing the kernel to write beyond the allocated stack buffer.

How to fix it

Upgrade the Linux kernel to a version containing commit c76bf8359188a11f8fd790e5bbd6077894a245cc or apply the fixed packages for Debian 11-14 which include the fix in version 3.19.

How to confirm the fix worked

Verify the kernel source includes the size check before loading vlenb, or check the running kernel version against the fixed commits.

Typical attack path

1. Identify RISC-V KVM host
2. Gain access to userspace process interacting with KVM
3. Craft malicious vlenb load request exceeding xlen bits
4. Trigger the vulnerable code path to cause overflow

How to detect it

Look for kernel stack overflow panics or oops messages related to KVM vlenb loading in system logs.

What your security team should do

• Apply kernel updates immediately on RISC-V systems
• Monitor for any KVM-related crashes
• Restrict untrusted access to KVM interfaces