{"id":"CVE-2025-40300","title":"x86/vmscape: Add conditional IBPB mitigation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/vmscape: Add conditional IBPB mitigation\n\nVMSCAPE is a vulnerability that exploits insufficient branch predictor\nisolation between a guest and a userspace hyperviso…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < ac60717f9a8d21c58617d0b34274babf24135835","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < c08192b5d6730a914dee6175bc71092ee6a65f14","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < d5490dfa35427a2967e00a4c7a1b95fdbc8ede34","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6e","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 15006289e5c38b2a830e1fba221977a27598176c","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 893387c18612bb452336a5881da0d015a7e8f4a2","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < f866eef8d1c65504d30923c3f14082ad294d0e6d","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 34e5667041050711a947e260fc9ebebe08bddee5","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < d7ddc93392e4a7ffcccc86edf6ef3e64c778db52","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 459274c77b37ac63b78c928b4b4e748d1f9d05c8","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 510603f504796c3535f67f55fb0b124a303b44c8","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 9c23a90648e831d611152ac08dbcd1283d405e7f","Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 2f8f173413f1cbf52660d04df92d0069c4306d25","Linux c51f1e5f57cca88d8d5894b6fad1638f643a99d0","Linux 4b3870c343a82cd2df7192cc5149c87205dcc611","Linux >= 3.16.57 < 3.17","Linux >= 4.4.168 < 4.5","Linux 4.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:41:37.391418Z"},"published":"2025-09-11","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:42:58.519Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40300","references":[{"url":"https://git.kernel.org/stable/c/ac60717f9a8d21c58617d0b34274babf24135835"},{"url":"https://git.kernel.org/stable/c/c08192b5d6730a914dee6175bc71092ee6a65f14"},{"url":"https://git.kernel.org/stable/c/d5490dfa35427a2967e00a4c7a1b95fdbc8ede34"},{"url":"https://git.kernel.org/stable/c/2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6e"},{"url":"https://git.kernel.org/stable/c/15006289e5c38b2a830e1fba221977a27598176c"},{"url":"https://git.kernel.org/stable/c/893387c18612bb452336a5881da0d015a7e8f4a2"},{"url":"https://git.kernel.org/stable/c/f866eef8d1c65504d30923c3f14082ad294d0e6d"},{"url":"https://git.kernel.org/stable/c/34e5667041050711a947e260fc9ebebe08bddee5"},{"url":"https://git.kernel.org/stable/c/d7ddc93392e4a7ffcccc86edf6ef3e64c778db52"},{"url":"https://git.kernel.org/stable/c/459274c77b37ac63b78c928b4b4e748d1f9d05c8"},{"url":"https://git.kernel.org/stable/c/510603f504796c3535f67f55fb0b124a303b44c8"},{"url":"https://git.kernel.org/stable/c/9c23a90648e831d611152ac08dbcd1283d405e7f"},{"url":"https://git.kernel.org/stable/c/2f8f173413f1cbf52660d04df92d0069c4306d25"}],"tags":["cve.org"],"epss":0.00344,"epssPercentile":0.28002,"ingestedAt":"2026-09-08T15:33:26.996Z","slug":"CVE-2025-40300","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/vmscape: Add conditional IBPB mitigation\n\nVMSCAPE is a vulnerability that exploits insufficient branch predictor\nisolation between a guest and a userspace hypervisor (like QEMU). Existing\nmitigations already protect kernel/KVM from a malicious guest. Userspace\ncan additionally be protected by flushing the branch predictors after a\nVMexit.\n\nSince it is the userspace that consumes the poisoned branch predictors,\nconditionally issue an IBPB after a VMexit and before returning to\nuserspace. Workloads that frequently switch between hypervisor and\nuserspace will incur the most overhead from the new IBPB.\n\nThis new IBPB is not integrated with the existing IBPB sites. For\ninstance, a task can use the existing speculation control prctl() to\nget an IBPB at context switch time. With this implementation, the\nIBPB is doubled up: one at context switch and another before running\nuserspace.\n\nThe intent is to integrate and optimize these cases post-embargo.\n\n[ dhansen: elaborate on suboptimal IBPB solution ]\n\n## Affected\n\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < ac60717f9a8d21c58617d0b34274babf24135835`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < c08192b5d6730a914dee6175bc71092ee6a65f14`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < d5490dfa35427a2967e00a4c7a1b95fdbc8ede34`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 2f4f2f8f860cb4c3336a7435ebe8dcfded0c9c6e`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 15006289e5c38b2a830e1fba221977a27598176c`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 893387c18612bb452336a5881da0d015a7e8f4a2`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < f866eef8d1c65504d30923c3f14082ad294d0e6d`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 34e5667041050711a947e260fc9ebebe08bddee5`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < d7ddc93392e4a7ffcccc86edf6ef3e64c778db52`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 459274c77b37ac63b78c928b4b4e748d1f9d05c8`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 510603f504796c3535f67f55fb0b124a303b44c8`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 9c23a90648e831d611152ac08dbcd1283d405e7f`\n- `Linux >= 15d45071523d89b3fb7372e2135fbd72f6af9506 < 2f8f173413f1cbf52660d04df92d0069c4306d25`\n- `Linux c51f1e5f57cca88d8d5894b6fad1638f643a99d0`\n- `Linux 4b3870c343a82cd2df7192cc5149c87205dcc611`\n- `Linux >= 3.16.57 < 3.17`\n- `Linux >= 4.4.168 < 4.5`\n- `Linux 4.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}