UBUNTU-CVE-2025-40300: Medium severity ubuntu/linux vulnerability

Q: Which systems are most exposed to this issue?

Systems running virtual machines with a userspace hypervisor such as QEMU are the relevant exposure scenario. The issue concerns insufficient branch predictor isolation between a guest and the userspace hypervisor after a VM exit.

Q: What would an attacker need to exploit it?

An attacker would need to control or operate a malicious guest VM that can poison branch predictor state and influence execution after a VM exit. The described risk is to userspace hypervisor components; existing mitigations already protect the kernel and KVM from a malicious guest.

Q: What is the mitigation if an update cannot be applied immediately?

The provided information does not describe an alternative configuration-based mitigation. Reducing exposure to untrusted or malicious guest VMs limits the stated attack scenario.

Q: Are there performance implications from the mitigation?

Yes. The mitigation conditionally issues an IBPB after VM exit and before returning to userspace, and workloads that frequently switch between the hypervisor and userspace will incur the most overhead. Some tasks using speculation-control prctl() may receive duplicate IBPB operations, including one at context switch and another before userspace runs.

Published Sep 11, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]

Affected Software

226 affected componentsFixes available

ubuntu/linux<3.13.0-208.259

3.13.0-208.259

ubuntu/linux-aws<4.4.0-1149.155

4.4.0-1149.155

ubuntu/linux-azure<4.15.0-1194.209~14.04.1

4.15.0-1194.209~14.04.1

ubuntu/linux-lts-xenial<4.4.0-274.308~14.04.1

4.4.0-274.308~14.04.1

ubuntu/linux<4.4.0-274.308

4.4.0-274.308

ubuntu/linux-aws<4.4.0-1187.202

4.4.0-1187.202

ubuntu/linux-aws-hwe<4.15.0-1186.199~16.04.1

4.15.0-1186.199~16.04.1

ubuntu/linux-azure<4.15.0-1194.209~16.04.1

4.15.0-1194.209~16.04.1

ubuntu/linux-gcp<4.15.0-1179.196~16.04.1

4.15.0-1179.196~16.04.1

ubuntu/linux-hwe<4.15.0-243.255~16.04.1

4.15.0-243.255~16.04.1

ubuntu/linux-kvm<4.4.0-1150.161

4.4.0-1150.161

ubuntu/linux-oracle<4.15.0-1148.159~16.04.1

4.15.0-1148.159~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1119.126

4.4.0-1119.126

ubuntu/linux-fips*

ubuntu/linux<4.15.0-243.255

4.15.0-243.255

ubuntu/linux-aws<4.15.0-1186.199

4.15.0-1186.199

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1152.162~18.04.1

5.4.0-1152.162~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1194.209

4.15.0-1194.209

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1156.163~18.04.1

5.4.0-1156.163~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1179.196

4.15.0-1179.196

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1155.164~18.04.1

5.4.0-1155.164~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-223.243~18.04.1

5.4.0-223.243~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1098.103~18.04.1

5.4.0-1098.103~18.04.1

ubuntu/linux-kvm<4.15.0-1168.173

4.15.0-1168.173

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1148.159

4.15.0-1148.159

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1150.160~18.04.1

5.4.0-1150.160~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1135.148~18.04.1

5.4.0-1135.148~18.04.1

ubuntu/linux-aws-fips<4.15.0-2124.130

4.15.0-2124.130

ubuntu/linux-azure-fips<4.15.0-2104.110

4.15.0-2104.110

ubuntu/linux-fips<4.15.0-1141.153

4.15.0-1141.153

ubuntu/linux-gcp-fips<4.15.0-2087.93

4.15.0-2087.93

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-223.243

5.4.0-223.243

ubuntu/linux-aws<5.4.0-1152.162

5.4.0-1152.162

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1096.103~20.04.1

5.15.0-1096.103~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1156.163

5.4.0-1156.163

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1102.111~20.04.1

5.15.0-1102.111~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1114.123~20.04.1

5.15.0-1114.123~20.04.1

ubuntu/linux-bluefield<5.4.0-1111.118

5.4.0-1111.118

ubuntu/linux-gcp<5.4.0-1155.164

5.4.0-1155.164

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1096.105~20.04.1

5.15.0-1096.105~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-161.171~20.04.1

5.15.0-161.171~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1098.103

5.4.0-1098.103

ubuntu/linux-ibm-5.15<5.15.0-1090.93~20.04.1

5.15.0-1090.93~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1091.97~20.04.1

5.15.0-1091.97~20.04.1

ubuntu/linux-iot<5.4.0-1056.59

5.4.0-1056.59

ubuntu/linux-kvm<5.4.0-1139.148

5.4.0-1139.148

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-161.171~20.04.1

5.15.0-161.171~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1048.48~20.04.1

5.15.0-1048.48~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1150.160

5.4.0-1150.160

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1093.99~20.04.1

5.15.0-1093.99~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi<5.4.0-1135.148

5.4.0-1135.148

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1091.95~20.04.1

5.15.0-1091.95~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1070.74

5.4.0-1070.74

ubuntu/linux-aws-fips<5.4.0-1152.162+fips1

5.4.0-1152.162+fips1

ubuntu/linux-azure-fips<5.4.0-1157.164+fips1

5.4.0-1157.164+fips1

ubuntu/linux-fips<5.4.0-1126.136

5.4.0-1126.136

ubuntu/linux-gcp-fips<5.4.0-1155.164+fips1

5.4.0-1155.164+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-161.171

5.15.0-161.171

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1096.103

5.15.0-1096.103

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1042.44~22.04.1

6.8.0-1042.44~22.04.1

ubuntu/linux-azure<5.15.0-1101.110

5.15.0-1101.110

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1044.50~22.04.1

6.8.0-1044.50~22.04.1

ubuntu/linux-azure-fde<5.15.0-1102.111.1

5.15.0-1102.111.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1046.53~22.04.1

6.8.0-1046.53~22.04.1

ubuntu/linux-gcp<5.15.0-1096.105

5.15.0-1096.105

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1043.46~22.04.1

6.8.0-1043.46~22.04.1

ubuntu/linux-gke<5.15.0-1092.98

5.15.0-1092.98

ubuntu/linux-gkeop<5.15.0-1079.87

5.15.0-1079.87

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-87.88~22.04.1

6.8.0-87.88~22.04.1

ubuntu/linux-ibm<5.15.0-1090.93

5.15.0-1090.93

ubuntu/linux-ibm-6.8<6.8.0-1040.40~22.04.1

6.8.0-1040.40~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1091.97

5.15.0-1091.97

ubuntu/linux-kvm<5.15.0-1089.94

5.15.0-1089.94

ubuntu/linux-lowlatency<5.15.0-161.171

5.15.0-161.171

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-87.88.1~22.04.1

6.8.0-87.88.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1091.92

5.15.0-1091.92

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1042.45~22.04.1

6.8.0-1042.45~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1048.48

5.15.0-1048.48

ubuntu/linux-nvidia-tegra-igx<5.15.0-1037.37

5.15.0-1037.37

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1093.99

5.15.0-1093.99

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1039.40~22.04.1

6.8.0-1039.40~22.04.1

ubuntu/linux-raspi<5.15.0-1090.93

5.15.0-1090.93

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-87.88~22.04.1

6.8.0-87.88~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1060.64

5.15.0-1060.64

ubuntu/linux-bluefield<5.15.0-1080.82

5.15.0-1080.82

ubuntu/linux-intel-iot-realtime<5.15.0-1088.90

5.15.0-1088.90

ubuntu/linux-realtime<5.15.0-1095.104

5.15.0-1095.104

ubuntu/linux-realtime-6.8<6.8.1-1037.38~22.04.1

6.8.1-1037.38~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1096.103+fips1

5.15.0-1096.103+fips1

ubuntu/linux-azure-fips<5.15.0-1101.110+fips1

5.15.0-1101.110+fips1

ubuntu/linux-fips<5.15.0-161.171+fips1

5.15.0-161.171+fips1

ubuntu/linux-gcp-fips<5.15.0-1096.105+fips1

5.15.0-1096.105+fips1

ubuntu/linux<6.8.0-87.88

6.8.0-87.88

ubuntu/linux-aws<6.8.0-1042.44

6.8.0-1042.44

ubuntu/linux-aws-6.14<6.14.0-1016.16~24.04.1

6.14.0-1016.16~24.04.1

ubuntu/linux-azure<6.8.0-1044.50

6.8.0-1044.50

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14<6.14.0-1017.17~24.04.1

6.14.0-1017.17~24.04.1

ubuntu/linux-azure-fde<6.8.0-1046.53

6.8.0-1046.53

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia<6.8.0-1029.32

6.8.0-1029.32

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1043.46

6.8.0-1043.46

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14<6.14.0-1019.20~24.04.1

6.14.0-1019.20~24.04.1

ubuntu/linux-gke<6.8.0-1039.44

6.8.0-1039.44

ubuntu/linux-gkeop<6.8.0-1026.29

6.8.0-1026.29

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm<6.8.0-1040.40

6.8.0-1040.40

ubuntu/linux-intel*

ubuntu/linux-lowlatency<6.8.0-87.88.1

6.8.0-87.88.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1042.45

6.8.0-1042.45

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-lowlatency<6.8.0-1042.45.1

6.8.0-1042.45.1

ubuntu/linux-nvidia-tegra<6.8.0-1012.12

6.8.0-1012.12

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14<6.14.0-1015.15

6.14.0-1015.15

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1039.40

6.8.0-1039.40

ubuntu/linux-oracle-6.14<6.14.0-1016.16~24.04.1

6.14.0-1016.16~24.04.1

ubuntu/linux-raspi<6.8.0-1042.46

6.8.0-1042.46

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14<6.14.0-35.35.1~24.04.1

6.14.0-35.35.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1019.20

6.8.0-1019.20

ubuntu/linux-bluefield<6.8.0-1013.17

6.8.0-1013.17

ubuntu/linux-raspi-realtime<6.8.0-2033.34

6.8.0-2033.34

ubuntu/linux-realtime<6.8.1-1037.38

6.8.1-1037.38

ubuntu/linux-realtime-6.14<6.14.0-1015.15~24.04.1

6.14.0-1015.15~24.04.1

ubuntu/linux-aws-fips<6.8.0-1042.44+fips1

6.8.0-1042.44+fips1

ubuntu/linux-azure-fips<6.8.0-1044.50+fips1

6.8.0-1044.50+fips1

ubuntu/linux-fips<6.8.0-87.88+fips1

6.8.0-87.88+fips1

ubuntu/linux-gcp-fips<6.8.0-1043.46+fips1

6.8.0-1043.46+fips1

ubuntu/linux-azure-fde*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-208.259
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1149.155
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.209~14.04.1
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-274.308~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-274.308
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1187.202
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1186.199~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.209~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1179.196~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-243.255~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1150.161
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1148.159~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1119.126
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-243.255
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1186.199
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.162~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1194.209
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1156.163~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1179.196
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1155.164~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-223.243~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1098.103~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1168.173
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1148.159
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1150.160~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1135.148~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2124.130
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2104.110
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1141.153
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2087.93
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-223.243
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.162
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.103~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1156.163
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.123~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1111.118
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1155.164
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-161.171~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1098.103
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1090.93~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1091.97~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1056.59
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1139.148
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-161.171~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.48~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1150.160
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1093.99~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1135.148
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1091.95~20.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1070.74
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.162+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1157.164+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1126.136
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1155.164+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-161.171
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.103
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.44~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1101.110
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.50~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.46~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.98
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.87
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-87.88~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1090.93
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1040.40~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1091.97
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.94
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-161.171
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-87.88.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1091.92
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.45~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.48
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1037.37
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1093.99
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.40~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1090.93
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-87.88~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1060.64
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.82
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.90
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.104
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1037.38~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.103+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1101.110+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-161.171+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.105+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-87.88
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.44
Upgrade
Upgrade ubuntu/linux-aws-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.50
Upgrade
Upgrade ubuntu/linux-azure-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.53
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.32
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.46
Upgrade
Upgrade ubuntu/linux-gcp-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1019.20~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.44
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.29
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1040.40
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-87.88.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.45
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.45.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1012.12
Upgrade
Upgrade ubuntu/linux-oem-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.40
Upgrade
Upgrade ubuntu/linux-oracle-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.46
Upgrade
Upgrade ubuntu/linux-riscv-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-35.35.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1019.20
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1013.17
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2033.34
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1037.38
Upgrade
Upgrade ubuntu/linux-realtime-6.14 to a version that resolves this vulnerability.
Fixed in 6.14.0-1015.15~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1042.44+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1044.50+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-87.88+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1043.46+fips1
Compensating control
Flush branch predictors after a VMexit before returning to userspace to protect userspace from poisoned branch predictors.

Event History

Sep 11, 2025

CVE Published

via OSV·05:15 PM

Data Sourced

via OSV·05:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are most exposed to this issue?

Systems running virtual machines with a userspace hypervisor such as QEMU are the relevant exposure scenario. The issue concerns insufficient branch predictor isolation between a guest and the userspace hypervisor after a VM exit.

What would an attacker need to exploit it?

An attacker would need to control or operate a malicious guest VM that can poison branch predictor state and influence execution after a VM exit. The described risk is to userspace hypervisor components; existing mitigations already protect the kernel and KVM from a malicious guest.

What is the mitigation if an update cannot be applied immediately?

The provided information does not describe an alternative configuration-based mitigation. Reducing exposure to untrusted or malicious guest VMs limits the stated attack scenario.

Are there performance implications from the mitigation?

Yes. The mitigation conditionally issues an IBPB after VM exit and before returning to userspace, and workloads that frequently switch between the hypervisor and userspace will incur the most overhead. Some tasks using speculation-control prctl() may receive duplicate IBPB operations, including one at context switch and another before userspace runs.

UBUNTU-CVE-2025-40300: Medium severity ubuntu/linux vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are most exposed to this issue?

What would an attacker need to exploit it?

What is the mitigation if an update cannot be applied immediately?

Are there performance implications from the mitigation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most exposed to this issue?

What would an attacker need to exploit it?

What is the mitigation if an update cannot be applied immediately?

Are there performance implications from the mitigation?