In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Write hgatp register with valid mode bits
According to the RISC-V Privileged Architecture Spec, when MODE=Bare
is selected,software must write zero to the remaining fields of hgatp.
We have detected the valid mode supported by the HW before, So using a
valid mode to detect how many vmid bits are supported.
< d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357 - AFFECTED
< 2b351e3d04be9e1533f26c3464f1e44a5beace30 - AFFECTED
5.16 - AFFECTED
< 5.16 - UNAFFECTED
<= 6.17.* - UNAFFECTED
<= * - UNAFFECTED
https://git.kernel.org/stable/c/d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357
https://git.kernel.org/stable/c/2b351e3d04be9e1533f26c3464f1e44a5beace30
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Write hgatp...
https://github.com/advisories/GHSA-m7w6-fmw8-2v8xIn the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Write hgatp register with valid mode bits
According to the RISC-V Privileged Architecture Spec, when MODE=Bare is selected,software must write zero to the remaining fields of hgatp.
We have detected the valid mode supported by the HW before, So using a valid mode to detect how many vmid bits are supported.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2025-40065",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"dateUpdated": "2025-10-28T11:48:35.785Z",
"dateReserved": "2025-04-16T07:20:57.159Z",
"datePublished": "2025-10-28T11:48:35.785Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2025-10-28T11:48:35.785Z"
},
"title": "RISC-V: KVM: Write hgatp register with valid mode bits",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Write hgatp register with valid mode bits\n\nAccording to the RISC-V Privileged Architecture Spec, when MODE=Bare\nis selected,software must write zero to the remaining fields of hgatp.\n\nWe have detected the valid mode supported by the HW before, So using a\nvalid mode to detect how many vmid bits are supported."
}
],
"affected": [
{
"vendor": "Linux",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/vmid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"defaultStatus": "unaffected",
"versions": [
{
"version": "fd7bb4a251dfc1da3496bf59a4793937c13e8c1f",
"status": "affected",
"versionType": "git",
"lessThan": "d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357"
},
{
"version": "fd7bb4a251dfc1da3496bf59a4793937c13e8c1f",
"status": "affected",
"versionType": "git",
"lessThan": "2b351e3d04be9e1533f26c3464f1e44a5beace30"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"programFiles": [
"arch/riscv/kvm/vmid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"defaultStatus": "affected",
"versions": [
{
"version": "5.16",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"versionType": "semver",
"lessThan": "5.16"
},
{
"version": "6.17.3",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.17.*"
},
{
"version": "6.18-rc1",
"status": "unaffected",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357"
},
{
"url": "https://git.kernel.org/stable/c/2b351e3d04be9e1533f26c3464f1e44a5beace30"
}
]
}
}
}