---
id: CVE-2025-40160
title: 'xen/events: Return -EEXIST for bound VIRQs'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xen/events: Return -EEXIST for bound VIRQs

  Change find_virq() to return -EEXIST when a VIRQ is bound to a
  different CPU than the one passed in.  With that, remove the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 <
    7e19b3643855d4b63442bd20e8bb811e1a75998e
  - >-
    Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 <
    612ef6056855c0aacb9b25d1d853c435754483f7
  - >-
    Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 <
    a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa
  - >-
    Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 <
    f81db055a793eca9d05f79658ff62adafb41d664
  - >-
    Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 <
    07ce121d93a5e5fb2440a24da3dbf408fcee978e
  - Linux 3.2
published: '2025-11-12'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:22:54.628Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40160'
references:
  - url: 'https://git.kernel.org/stable/c/7e19b3643855d4b63442bd20e8bb811e1a75998e'
  - url: 'https://git.kernel.org/stable/c/612ef6056855c0aacb9b25d1d853c435754483f7'
  - url: 'https://git.kernel.org/stable/c/a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa'
  - url: 'https://git.kernel.org/stable/c/f81db055a793eca9d05f79658ff62adafb41d664'
  - url: 'https://git.kernel.org/stable/c/07ce121d93a5e5fb2440a24da3dbf408fcee978e'
tags:
  - cve.org
epss: 0.00201
epssPercentile: 0.10026
ingestedAt: '2026-11-03T23:58:20.715Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xen/events: Return -EEXIST for bound VIRQs

Change find_virq() to return -EEXIST when a VIRQ is bound to a
different CPU than the one passed in.  With that, remove the BUG_ON()
from bind_virq_to_irq() to propogate the error upwards.

Some VIRQs are per-cpu, but others are per-domain or global.  Those must
be bound to CPU0 and can then migrate elsewhere.  The lookup for
per-domain and global will probably fail when migrated off CPU 0,
especially when the current CPU is tracked.  This now returns -EEXIST
instead of BUG_ON().

A second call to bind a per-domain or global VIRQ is not expected, but
make it non-fatal to avoid trying to look up the irq, since we don't
know which per_cpu(virq_to_irq) it will be in.

## Affected

- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 7e19b3643855d4b63442bd20e8bb811e1a75998e`
- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 612ef6056855c0aacb9b25d1d853c435754483f7`
- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < a1e7f07ae6b594f1ba5be46c6125b43bc505c5aa`
- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < f81db055a793eca9d05f79658ff62adafb41d664`
- `Linux >= 62cc5fc7b2e0218144e162afb8191db9b924b5e6 < 07ce121d93a5e5fb2440a24da3dbf408fcee978e`
- `Linux 3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.