CVE-2025-37885

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Reset IRTE to host control if new route isn't postable

Restore an IRTE back to host control (remapped or posted MSI mode) if the new GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing type. Updating the IRTE if and only if the new GSI is an MSI results in KVM leaving an IRTE posting to a vCPU.

The dangling IRTE can result in interrupts being incorrectly delivered to the guest, and in the worst case scenario can result in use-after-free, e.g. if the VM is torn down, but the underlying host IRQ isn't freed.

This vulnerability is rated as Moderate because exploitation requires local administrative or hypervisor-level privileges to modify KVM interrupt routing configurations on x86 virtualization hosts. When routing updates prevent direct posting of interrupts to a virtual CPU, the kernel may fail to return the hardware remapping table entry to host control. If the associated virtual machine is subsequently destroyed while host interrupts remain active, this can trigger a use-after-free leading to host instability or denial of service. Standard unprivileged guest workloads cannot trigger this flaw without compromised or misconfigured hypervisor process permissions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.