CVE-2025-23135: RISC-V: KVM: Teardown riscv specific bits after kvm_exit
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Teardown riscv specific bits after kvmexit
During a module removal, kvmexit invokes arch specific disable call which disables AIA. However, we invoke aiaexit before kvmexit resulting in the following warning. KVM kernel module can't be inserted afterwards due to inconsistent state of IRQ.
[25469.031389] percpu IRQ 31 still enabled on CPU0! [25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 freepercpuirq+0xa2/0x150 [25469.031804] Modules linked in: kvm(-) [25469.031848] CPU: 3 UID: 0 PID: 943 Comm: rmmod Not tainted 6.14.0-rc5-06947-g91c763118f47-dirty #2 [25469.031905] Hardware name: riscv-virtio,qemu (DT) [25469.031928] epc : freepercpuirq+0xa2/0x150 [25469.031976] ra : freepercpuirq+0xa2/0x150 [25469.032197] epc : ffffffff8007db1e ra : ffffffff8007db1e sp : ff2000000088bd50 [25469.032241] gp : ffffffff8131cef8 tp : ff60000080b96400 t0 : ff2000000088baf8 [25469.032285] t1 : fffffffffffffffc t2 : 5249207570637265 s0 : ff2000000088bd90 [25469.032329] s1 : ff60000098b21080 a0 : 037d527a15eb4f00 a1 : 037d527a15eb4f00 [25469.032372] a2 : 0000000000000023 a3 : 0000000000000001 a4 : ffffffff8122dbf8 [25469.032410] a5 : 0000000000000fff a6 : 0000000000000000 a7 : ffffffff8122dc10 [25469.032448] s2 : ff60000080c22eb0 s3 : 0000000200000022 s4 : 000000000000001f [25469.032488] s5 : ff60000080c22e00 s6 : ffffffff80c351c0 s7 : 0000000000000000 [25469.032582] s8 : 0000000000000003 s9 : 000055556b7fb490 s10: 00007ffff0e12fa0 [25469.032621] s11: 00007ffff0e13e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7 [25469.032664] t5 : ffffffff81354ac8 t6 : ffffffff81354ac7 [25469.032698] status: 0000000200000100 badaddr: ffffffff8007db1e cause: 0000000000000003 [25469.032738] [<ffffffff8007db1e>] freepercpuirq+0xa2/0x150 [25469.032797] [<ffffffff8007dbfc>] freepercpuirq+0x30/0x5e [25469.032856] [<ffffffff013a57dc>] kvmriscvaiaexit+0x40/0x42 [kvm] [25469.033947] [<ffffffff013b4e82>] cleanupmodule+0x10/0x32 [kvm] [25469.035300] [<ffffffff8009b150>] riscvsysdeletemodule+0x18e/0x1fc [25469.035374] [<ffffffff8000c1ca>] syscallhandler+0x3a/0x46 [25469.035456] [<ffffffff809ec9a4>] dotrapecallu+0x72/0x134 [25469.035536] [<ffffffff809f5e18>] handleexception+0x148/0x156
Invoke aiaexit and other arch specific cleanup functions after kvmexit so that disable gets a chance to be called first before exit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (KVM)to a version that resolves this vulnerability.Fixed in 6.14.0-rc5-06947-g91c763118f47-dirty - Configuration
During KVM module removal/teardown, invoke aia_exit and other arch-specific cleanup functions after kvm_exit (i.e., ensure AIA disable/teardown happens in the correct order to avoid inconsistent IRQ state and the WARNING about per-cpu IRQ still enabled).
Linux kernel (KVM module teardown on RISC-V with AIA) Invoke order of arch-specific cleanup functions = Move invocation of aia_exit (and other arch-specific cleanup) to occur after kvm_exit during module removal/teardown (so AIA disable runs before exit)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23135?
CVE-2025-23135 has a medium severity rating due to its impact on the RISC-V architecture in the Linux kernel.
How do I fix CVE-2025-23135?
To fix CVE-2025-23135, you should update to the latest stable version of the Linux kernel that addresses this vulnerability.
What type of systems are affected by CVE-2025-23135?
CVE-2025-23135 specifically affects systems running the Linux kernel on RISC-V architectures.
What does CVE-2025-23135 affect in the Linux kernel?
CVE-2025-23135 affects the KVM (Kernel-based Virtual Machine) functionality in the Linux kernel.
Is there a workaround for CVE-2025-23135?
Currently, there are no recommended workarounds for CVE-2025-23135; updating the kernel is the best mitigation strategy.