CVE-2024-58083 KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting KVM and Intel Performance Monitoring Two vulnerabilities have been reported affecting KVM and Intel performance monitoring features. CVE-2025-23141 involves acquiring SRCU in KVM_GET_MP_STATE to protect guest memory accesses, while CVE-2025-37936 addresses issues with PEBS_ENABLE for guests with specific vCPU values. Both vulnerabilities were published in 2025 and may impact systems utilizing these technologies. 8 sources 41