Buffer Overflow Vulnerability in Linux Kernel Affecting KVM Functions

CVE-2025-39704

What is CVE-2025-39704?

A vulnerability exists in the Kernel-based Virtual Machine (KVM) of the Linux kernel, specifically within the send_ipi_data() function. Improper buffer size handling for the parameter *val—expected to be at least 8 bytes—can lead to potential stack corruption when CONFIG_STACKPROTECTOR is enabled. Functions such as loongarch_ipi_readl() and kvm_eiointc_read() may incorrectly write to the buffer, triggering a kernel panic and allowing exploitation. Immediate patching is recommended to mitigate this risk.

References