In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards. Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON(). A second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1316 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: essiv - Check ssize for decryption and in-place encryption (CVE-2025-40019)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/ksm: fix flag-dropping behavior in ksm_madvise (CVE-2025-40040)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (CVE-2025-40042)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: parse_dfs_referrals: prevent oob on malformed input (CVE-2025-40099)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not assert we found block group item when creating free space tree (CVE-2025-40100)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (CVE-2025-40101)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix refcount leak for cifs_sb_tlink (CVE-2025-40103)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: fix mailbox API compatibility by negotiating supported features (CVE-2025-40104)

    In the Linux kernel, the following vulnerability has been resolved:

    vfs: Don't leak disconnected dentries on umount (CVE-2025-40105)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/vmwgfx: Fix a null-ptr access in the cursor snooper (CVE-2025-40110)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/vmwgfx: Fix Use-after-free in validation (CVE-2025-40111)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (CVE-2025-40133)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: Harden userspace-supplied xdp_desc validation (CVE-2025-40159)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/events: Return -EEXIST for bound VIRQs (CVE-2025-40160)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: detect invalid INLINE_DATA + EXTENTS flag combination (CVE-2025-40167)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ip6_tunnel: Prevent perpetual tunnel growth (CVE-2025-40173)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: Add a judgment for ns null in pid_nr_ns (CVE-2025-40178)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: verify orphan file size is not too big (CVE-2025-40179)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (CVE-2025-40181)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (CVE-2025-40183)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (CVE-2025-40187)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: guard against EA inode refcount underflow in xattr update (CVE-2025-40190)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (CVE-2025-40194)

    In the Linux kernel, the following vulnerability has been resolved:

    mount: handle NULL values in mnt_ns_release() (CVE-2025-40195)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: quota: create dedicated workqueue for quota_release_work (CVE-2025-40196)

    In the Linux kernel, the following vulnerability has been resolved:

    media: mc: Clear minor number before put device (CVE-2025-40197)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (CVE-2025-40198)

    In the Linux kernel, the following vulnerability has been resolved:

    page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (CVE-2025-40199)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: reject negative file sizes in squashfs_read_inode() (CVE-2025-40200)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (CVE-2025-40201)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: Rework user message limit handling (CVE-2025-40202)

    In the Linux kernel, the following vulnerability has been resolved:

    listmount: don't call path_put() under namespace semaphore (CVE-2025-40203)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: Fix MAC comparison to be constant-time (CVE-2025-40204)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (CVE-2025-40205)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_objref: validate objref and objrefmap expressions (CVE-2025-40206)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (CVE-2025-40207)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a     different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate     the error upwards. Some VIRQs are per-cpu, but others are per-domain or global. Those must be bound to     CPU0 and can then migrate elsewhere. The lookup for per-domain and global will probably fail when migrated     off CPU 0, especially when the current CPU is tracked. This now returns -EEXIST instead of BUG_ON(). A     second call to bind a per-domain or global VIRQ is not expected, but make it non-fatal to avoid trying to     look up the irq, since we don't know which per_cpu(virq_to_irq) it will be in. (CVE-2025-40160)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
277808	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1316)	Nessus	Amazon Linux Local Security Checks	high
275190	Linux Distros Unpatched Vulnerability : CVE-2025-40160	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-40160

medium

Tenable Plugins

high

medium