In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its hand…

published 2024-05-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-23050

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.

Patch / fix

distros 7 links 2

debian ubuntu red hat suse opensuse almalinux rocky linux

linux Debian 14, Debian 13 6.9.7-1

debian advisories DEBIAN-CVE-2024-25742

linux Ubuntu 22.04 LTS 5.15.0-117.127
linux Ubuntu 24.04 LTS 6.8.0-39.39
linux-aws Ubuntu 22.04 LTS 5.15.0-1066.72
linux-aws Ubuntu 24.04 LTS 6.8.0-1012.13
linux-gcp Ubuntu 22.04 LTS 5.15.0-1065.73
linux-gcp Ubuntu 24.04 LTS 6.8.0-1011.12
linux-gke Ubuntu 22.04 LTS 5.15.0-1063.69
linux-gke Ubuntu 24.04 LTS 6.8.0-1007.10

ubuntu advisories UBUNTU-CVE-2024-25742

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt RHEL 8 4.18.0-553.rt7.342.el8_10
kernel-rt-kvm RHEL 8 4.18.0-553.rt7.342.el8_10
kernel-rt-core RHEL 8 4.18.0-553.rt7.342.el8_10
kernel-rt-modules RHEL 8 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-kvm RHEL 8 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-core RHEL 8 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-modules RHEL 8 4.18.0-553.rt7.342.el8_10
kernel-rt-modules-extra RHEL 8 4.18.0-553.rt7.342.el8_10

red hat advisories RHSA-2024:2950 RHSA-2024:3138 RHSA-2024:3421 RHSA-2024:3810 RHSA-2024:2627 RHSA-2024:2628

kernel-64kb SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 5.14.21-150400.24.119.1
kernel-syms SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 5.14.21-150400.24.119.1
kernel-source SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 5.14.21-150400.24.119.1
kernel-default SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +9 more 5.14.21-150400.24.119.1
kernel-zfcpdump SLES 15 SP4-LTSS, Manager Server 4.3 5.14.21-150400.24.119.1
kernel-obs-build SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 5.14.21-150400.24.119.1
kernel-default-base SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +7 more 5.14.21-150400.24.119.1.150400.24.56.1
kernel-azure SLE Module for Public Cloud 15 SP5, openSUSE Leap 15.5 5.14.21-150500.33.48.1

suse advisories SUSE-SU-2024:1641-1 SUSE-SU-2024:1490-1 SUSE-SU-2024:1480-1 SUSE-SU-2024:1466-1 SUSE-SU-2024:1321-1 SUSE-SU-2024:1320-1

ovmf openSUSE Tumbleweed 202405-1.1

opensuse advisories openSUSE-SU-2024:14336-1

kernel-rt AlmaLinux 8 4.18.0-553.rt7.342.el8_10
kernel-rt-kvm AlmaLinux 8 4.18.0-553.rt7.342.el8_10
kernel-rt-core AlmaLinux 8 4.18.0-553.rt7.342.el8_10
kernel-rt-modules AlmaLinux 8 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-kvm AlmaLinux 8 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-core AlmaLinux 8 4.18.0-553.rt7.342.el8_10
kernel-rt-debug-modules AlmaLinux 8 4.18.0-553.rt7.342.el8_10
kernel-rt-modules-extra AlmaLinux 8 4.18.0-553.rt7.342.el8_10

almalinux advisories ALSA-2024:2950 ALSA-2024:3138 ALSA-2024:2758

kernel Rocky Linux 8 4.18.0-553.123.1.el8_10.cloud.0.1
kernel-rt Rocky Linux 8 4.18.0-553.rt7.342.el8_10
kernel Rocky Linux 8 4.18.0-553.el8_10
kernel Rocky Linux 9 5.14.0-427.16.1.el9_4

rocky linux advisories RXSA-2024:3138 RLSA-2024:2950 RLSA-2024:3138 RLSA-2024:2758

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-05-20)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CNA	3.1	6.5	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Classification

Weakness

CWE-828 Signal Handler with Functionality that is not Asynchronous-Safe

References

Sources

CVE List CVE-2024-25742
NVD CVE-2024-25742

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary