CVE Tools

CVE-2025-40160

xen/events: Return -EEXIST for bound VIRQs

Published: Nov 12, 2025Updated: Nov 12, 2025 Sources: CVE List NVD BDU

Description

In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards. Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON(). A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.

CVSS Vector Breakdown

AV:LAC:LC:NI:NA:L
Exploitability
AV:LAccess Vector
Local
AC:LAccess Complexity
Low
Impact
C:NConfidentiality
None
I:NIntegrity
None
A:LAvailability
L

Affected Products

linuxoss-projectOperating Systemsaka the linux kernel
red hat inc.commercialUSOperating Systemsaka red hat
and 4 more affected products View all →

Exploitability

Official Patch Available

References

and 7 more references View all →

Timeline

Published
Nov 12, 2025
Last Updated
Nov 12, 2025

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-40160 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows