---
id: CVE-2025-40065
title: 'RISC-V: KVM: Write hgatp register with valid mode bits'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RISC-V: KVM: Write hgatp register with valid mode bits

  According to the RISC-V Privileged Architecture Spec, when MODE=Bare
  is selected,software must write zero to the…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f <
    8b6e327736db013b9e385c3f6f9f0b04ddf26e43
  - >-
    Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f <
    5cba8ae00279296a586d0596443109d601b1d116
  - >-
    Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f <
    d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357
  - >-
    Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f <
    2b351e3d04be9e1533f26c3464f1e44a5beace30
  - Linux 5.16
published: '2025-10-28'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:44.298Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40065'
references:
  - url: 'https://git.kernel.org/stable/c/8b6e327736db013b9e385c3f6f9f0b04ddf26e43'
  - url: 'https://git.kernel.org/stable/c/5cba8ae00279296a586d0596443109d601b1d116'
  - url: 'https://git.kernel.org/stable/c/d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357'
  - url: 'https://git.kernel.org/stable/c/2b351e3d04be9e1533f26c3464f1e44a5beace30'
tags:
  - cve.org
epss: 0.00238
epssPercentile: 0.14725
ingestedAt: '2026-10-21T12:48:53.683Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Write hgatp register with valid mode bits

According to the RISC-V Privileged Architecture Spec, when MODE=Bare
is selected,software must write zero to the remaining fields of hgatp.

We have detected the valid mode supported by the HW before, So using a
valid mode to detect how many vmid bits are supported.

## Affected

- `Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f < 8b6e327736db013b9e385c3f6f9f0b04ddf26e43`
- `Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f < 5cba8ae00279296a586d0596443109d601b1d116`
- `Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f < d00b61cd37f4c183ce0edbc9f8ccf6d5430ea357`
- `Linux >= fd7bb4a251dfc1da3496bf59a4793937c13e8c1f < 2b351e3d04be9e1533f26c3464f1e44a5beace30`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.