CVE-2025-40136: 
Linux Debian vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2025-40136) was discovered related to the handling of reserved interrupts for virtual functions in the Hisilicon/qm crypto driver. The issue was disclosed on November 12, 2025, affecting various Linux kernel versions (NVD, Ubuntu).

The vulnerability stems from the device interrupt vector 3, which serves as an error interrupt for physical function and a reserved interrupt for virtual function. The driver failed to register the reserved interrupt for virtual function. When allocating interrupts based on powers of two, this interrupt is included. When the system enables GICv4 and virtual function passthrough to the virtual machine, releasing the interrupt in the driver triggers a warning at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4 (NVD).

The impact appears to be limited to system warnings when specific conditions are met, particularly when using GICv4 with virtual function passthrough to virtual machines. This suggests a relatively low severity issue primarily affecting system stability rather than security (NVD).

The fix involves registering a reserved interrupt for VF and setting the IRQF_NO_AUTOEN flag to prevent the warning. This solution has been implemented in the Linux kernel (NVD).