{"id":"CVE-2025-40160","title":"xen/events: Return -EEXIST for bound VIRQs","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/events: Return -EEXIST for bound VIRQs\n\nChange find_virq() to return -EEXIST when a VIRQ is bound to a\ndifferent CPU than the one passed in.  With that, remove the …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 7e19b3643855d4b63442bd20e8bb811e1a75998e","Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 612ef6056855c0aacb9b25d1d853c435754483f7","Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa","Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < f81db055a793eca9d05f79658ff62adafb41d664","Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 07ce121d93a5e5fb2440a24da3dbf408fcee978e","Linux 3.2"],"published":"2025-11-12","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:22:54.628Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-40160","references":[{"url":"https://git.kernel.org/stable/c/7e19b3643855d4b63442bd20e8bb811e1a75998e"},{"url":"https://git.kernel.org/stable/c/612ef6056855c0aacb9b25d1d853c435754483f7"},{"url":"https://git.kernel.org/stable/c/a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa"},{"url":"https://git.kernel.org/stable/c/f81db055a793eca9d05f79658ff62adafb41d664"},{"url":"https://git.kernel.org/stable/c/07ce121d93a5e5fb2440a24da3dbf408fcee978e"}],"tags":["cve.org"],"epss":0.00201,"epssPercentile":0.10026,"ingestedAt":"2026-11-03T23:58:20.715Z","slug":"CVE-2025-40160","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen/events: Return -EEXIST for bound VIRQs\n\nChange find_virq() to return -EEXIST when a VIRQ is bound to a\ndifferent CPU than the one passed in.  With that, remove the BUG_ON()\nfrom bind_virq_to_irq() to propogate the error upwards.\n\nSome VIRQs are per-cpu, but others are per-domain or global.  Those must\nbe bound to CPU0 and can then migrate elsewhere.  The lookup for\nper-domain and global will probably fail when migrated off CPU 0,\nespecially when the current CPU is tracked.  This now returns -EEXIST\ninstead of BUG_ON().\n\nA second call to bind a per-domain or global VIRQ is not expected, but\nmake it non-fatal to avoid trying to look up the irq, since we don't\nknow which per_cpu(virq_to_irq) it will be in.\n\n## Affected\n\n- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 7e19b3643855d4b63442bd20e8bb811e1a75998e`\n- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 612ef6056855c0aacb9b25d1d853c435754483f7`\n- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa`\n- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < f81db055a793eca9d05f79658ff62adafb41d664`\n- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 07ce121d93a5e5fb2440a24da3dbf408fcee978e`\n- `Linux 3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}