cbcvebase.
CVE-2025-21839
published 2025-03-07

CVE-2025-21839: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.7th percentile
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load hardware with a stale vcpu->arch.dr6. When the guest accesses a DR and host userspace isn't debugging the guest, KVM disables DR interception and loads the guest's values into hardware on VM-Enter and saves them on VM-Exit. This allows the guest to access DRs at will, e.g. so that a sequence of DR accesses to configure a breakpoint only generates one VM-Exit. For DR0-DR3, the logic/behavior is identical between VMX and SVM, and also identical between KVM_DEBUGREG_BP_ENABLED (userspace debugging the guest) and KVM_DEBUGREG_WONT_EXIT (guest using DRs), and so KVM handles loading DR0-DR3 in common code, _outside_ of the core kvm_x86_ops.vcpu_run() loop. But for DR6, the guest's value doesn't need to be loaded into hardware for KVM_DEBUGREG_BP_ENABLED, and SVM provides a dedicated VMCB field whereas VMX requires software to manually load the guest value, and so loading the guest's value into DR6 is handled by {svm,vmx}_vcpu_run(), i.e. is done _inside_ the core run loop. Unfortunately, saving the guest values on VM-Exit is initiated by common x86, again outside of the core run loop. If the guest modifies DR6 (in hardware, when DR interception is disabled), and then the next VM-Exit is a fastpath VM-Exit, KVM will reload hardware DR6 with vcpu->arch.dr6 and clobber the guest's actual value. The bug shows up primarily with nested VMX because KVM handles the VMX preemption timer in the fastpath, and the window between hardware DR6 being modified (in guest context) and DR6 being read by guest software is orders of magnitude larger in a nested setup. E.g. in non-nested, the VMX preemption timer would need to fire precisely between #DB injection and the #DB handler's read of DR6, whereas with a

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.140-1 (bookworm)linux 6.1.140-1 (bookworm)
debianlinux-6.1< linux 6.1.140-1 (bookworm)linux 6.1.140-1 (bookworm)
linuxlinux——
linuxlinux>= d67668e9dd76d98136048935723947156737932b < 9efb2b99b96c86664bbdbdd2cdb354ac9627eb209efb2b99b96c86664bbdbdd2cdb354ac9627eb20
linuxlinux>= d67668e9dd76d98136048935723947156737932b < 93eeb6df1605b3a24f38afdba7ab903ba6b6413393eeb6df1605b3a24f38afdba7ab903ba6b64133
linuxlinux>= d67668e9dd76d98136048935723947156737932b < a1723e9c53fe6431415be19302a56543daf503f5a1723e9c53fe6431415be19302a56543daf503f5
linuxlinux>= d67668e9dd76d98136048935723947156737932b < 4eb063de686bfcdfd03a8c801d1bbe87d2d5eb554eb063de686bfcdfd03a8c801d1bbe87d2d5eb55
linuxlinux>= d67668e9dd76d98136048935723947156737932b < d456de38d9eb753a4e9fde053c18d4ef8e485339d456de38d9eb753a4e9fde053c18d4ef8e485339
linuxlinux>= d67668e9dd76d98136048935723947156737932b < c2fee09fc167c74a64adb08656cb993ea475197ec2fee09fc167c74a64adb08656cb993ea475197e
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 6.1.140-16.1.140-1
linuxlinux_kernel>= 0 < 6.12.16-16.12.16-1
linuxlinux_kernel>= 0 < 6.12.16-16.12.16-1
linuxlinux_kernel>= 0 < 5.15.0-144.1575.15.0-144.157
linuxlinux_kernel>= 0 < 6.8.0-78.786.8.0-78.78
linuxlinux_kernel>= 5.16 < 6.1.1386.1.138
linuxlinux_kernel>= 5.7.1 < 5.15.1825.15.182
linuxlinux_kernel>= 6.13 < 6.13.46.13.4
linuxlinux_kernel>= 6.2 < 6.6.906.6.90
linuxlinux_kernel>= 6.7 < 6.12.166.12.16
msrcazl3_kernel_6.6.85.1-4_on_azure_linux_3.0——

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.