CVE-2025-40102 — Missing Initialization of Resource in Linux

CWE-909 — Missing Initialization of Resource16 documents7 sources
Severity
5.5MEDIUM
No vector
EPSS
0.1%
top 81.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
LinuxLinux KernelDebian Linux+8 more
Timeline
PublishedOct 30
Latest updateFeb 24

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tr…

Affected Packages13 packages

▶Linuxlinux/linux_kernel4.19.0 — 6.17.5
▶Debianlinux/linux_kernel< 6.17.6-1
▶Ubuntulinux/linux_kernel< 6.17.0-14.14

🔴Vulnerability Details

8
OSV
linux-azure vulnerabilities↗2026-02-24
▶
OSV
linux-oem-6.17 vulnerabilities↗2026-02-17
▶
OSV
linux-aws, linux-oracle vulnerabilities↗2026-02-17
▶
OSV
linux-gcp vulnerabilities↗2026-02-12
▶
OSV
linux, linux-raspi, linux-realtime vulnerabilities↗2026-02-12
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel (Azure) vulnerabilities↗2026-02-24
▶
Ubuntu
Linux kernel (OEM) vulnerabilities↗2026-02-17
▶
Ubuntu
Linux kernel (GCP) vulnerabilities↗2026-02-12
▶
Ubuntu
Linux kernel vulnerabilities↗2026-02-12
▶
Red Hat
kernel: Linux kernel KVM: Denial of Service due to uninitialized vCPU event handling↗2025-10-30
▶