---
id: CVE-2025-39823
title: 'KVM: x86: use array_index_nospec with indices that come from guest'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  KVM: x86: use array_index_nospec with indices that come from guest

  min and dest_id are guest-controlled indices. Using array_index_nospec()
  after the bounds checks cla…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    31a0ad2f60cb4816e06218b63e695eb72ce74974
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    d51e381beed5e2f50f85f49f6c90e023754efa12
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    f49161646e03d107ce81a99c6ca5da682fe5fb69
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    67a05679621b7f721bdba37a5d18665d3aceb695
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    f57a4bd8d6cb5af05b8ac1be9098e249034639fb
  - >-
    Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 <
    c87bd4dd43a624109c3cc42d843138378a7f4548
  - Linux 4.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:12:15.590639Z'
published: '2025-09-16'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:59.446Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39823'
references:
  - url: 'https://git.kernel.org/stable/c/72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48'
  - url: 'https://git.kernel.org/stable/c/31a0ad2f60cb4816e06218b63e695eb72ce74974'
  - url: 'https://git.kernel.org/stable/c/d51e381beed5e2f50f85f49f6c90e023754efa12'
  - url: 'https://git.kernel.org/stable/c/33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f'
  - url: 'https://git.kernel.org/stable/c/f49161646e03d107ce81a99c6ca5da682fe5fb69'
  - url: 'https://git.kernel.org/stable/c/67a05679621b7f721bdba37a5d18665d3aceb695'
  - url: 'https://git.kernel.org/stable/c/f57a4bd8d6cb5af05b8ac1be9098e249034639fb'
  - url: 'https://git.kernel.org/stable/c/c87bd4dd43a624109c3cc42d843138378a7f4548'
tags:
  - cve.org
epss: 0.00181
epssPercentile: 0.07718
ingestedAt: '2026-11-05T22:38:32.031Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: use array_index_nospec with indices that come from guest

min and dest_id are guest-controlled indices. Using array_index_nospec()
after the bounds checks clamps these values to mitigate speculative execution
side-channels.

## Affected

- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < 72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48`
- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < 31a0ad2f60cb4816e06218b63e695eb72ce74974`
- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < d51e381beed5e2f50f85f49f6c90e023754efa12`
- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < 33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f`
- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < f49161646e03d107ce81a99c6ca5da682fe5fb69`
- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < 67a05679621b7f721bdba37a5d18665d3aceb695`
- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < f57a4bd8d6cb5af05b8ac1be9098e249034639fb`
- `Linux >= 4180bf1b655a791a0a6ef93a2ffffc762722c782 < c87bd4dd43a624109c3cc42d843138378a7f4548`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.