CVE-2025-40102

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64 architectures. A local user can exploit this vulnerability by sending virtual CPU (vCPU) events to a vCPU that has not been properly initialized. This improper handling of uninitialized vCPU events can lead to the kernel interpreting garbage data, causing the vCPU to enter an illegal state and triggering a kernel bug, ultimately resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If virtualization is not required on ARM64 systems, the kvm_arm64 kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by creating a modprobe configuration file:

echo "install kvm_arm64 /bin/true" > /etc/modprobe.d/disable-kvm_arm64.conf

After creating the file, a system reboot is required for the changes to take effect. This mitigation will prevent the system from hosting ARM64 virtual machines.