---
id: CVE-2025-68259
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

  When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
  instruction, discard the ex…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

  When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
  instruction, discard the ex…
severity: none
published: '2025-12-16'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68259'
references:
  - url: 'https://git.kernel.org/stable/c/152289a51107ef45bbfe9b4aeeaa584a503042b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2e84a018c2895c05abe213eb10db128aa45f6ec6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4da3768e1820cf15cced390242d8789aed34f54d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/53903ac9ca1abffa27327e85075ec496fa55ccf3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/54bcccc2c7805a00af1d7d2faffd6f424c0133aa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/87cc1622c88a4888959d64fa1fc9ba1e264aa3d4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00193
epssPercentile: 0.08278
ingestedAt: '2026-10-14T13:30:58.469Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
instruction, discard the exception and retry the instruction if the code
stream is changed (e.g. by a different vCPU) between when the CPU
executes the instruction and when KVM decodes the instruction to get the
next RIP.

As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject
INT3/INTO instead of retrying the instruction"), failure to verify that
the correct INTn instruction was decoded can effectively clobber guest
state due to decoding the wrong instruction and thus specifying the
wrong next RIP.

The bug most often manifests as "Oops: int3" panics on static branch
checks in Linux guests.  Enabling or disabling a static branch in Linux
uses the kernel's "text poke" code patching mechanism.  To modify code
while other CPUs may be executing that code, Linux (temporarily)
replaces the first byte of the original instruction with an int3 (opcode
0xcc), then patches in the new code stream except for the first byte,
and finally replaces the int3 with the first byte of the new code
stream.  If a CPU hits the int3, i.e. executes the code while it's being
modified, then the guest kernel must look up the RIP to determine how to
handle the #BP, e.g. by emulating the new instruction.  If the RIP is
incorrect, then this lookup fails and the guest kernel panics.

The bug reproduces almost instantly by hacking the guest kernel to
repeatedly check a static branch[1] while running a drgn script[2] on
the host to constantly swap out the memory containing the guest's TSS.

[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.