CVE-2025-39823

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: use array_index_nospec with indices that come from guest

min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.

Guest-controlled indices in KVM (PV send IPI / sched yield paths) could be speculatively used out-of-bounds, enabling a Spectre v1-style side channel to leak kernel/host data to a malicious guest. The fix clamps indices with array_index_nospec() after bounds checks, mitigating speculative out-of-bounds access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.