cbcvebase.
CVE-2025-71104
published 2026-01-14

CVE-2025-71104: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer When…

PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
0.8th percentile
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively w

Affected

72 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 4.14.45 < 4.154.15
linuxlinux>= 4.16.13 < 4.174.17
linuxlinux>= d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc < 786ed625c125c5cd180d6aaa37e653e3e4ffb8d9786ed625c125c5cd180d6aaa37e653e3e4ffb8d9
linuxlinux>= d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc < d2da0df7bbc4fb4fd7d0a1da704f81a09c72fe73d2da0df7bbc4fb4fd7d0a1da704f81a09c72fe73
linuxlinux>= d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc < 807dbe8f3862fa7c164155857550ce94b36a11b9807dbe8f3862fa7c164155857550ce94b36a11b9
linuxlinux>= d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc < 7b54ccef865e0aa62e4871d4ada2ba4b9dcb8bed7b54ccef865e0aa62e4871d4ada2ba4b9dcb8bed
linuxlinux>= d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc < e746e51947053a02af2ea964593dc4887108d379e746e51947053a02af2ea964593dc4887108d379
linuxlinux>= d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc < e23f46f1a971c73dad2fd63e1408696114ddebe2e23f46f1a971c73dad2fd63e1408696114ddebe2
linuxlinux>= d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc < 18ab3fc8e880791aa9f7c000261320fc812b546518ab3fc8e880791aa9f7c000261320fc812b5465
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.249-15.10.249-1
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.