CVE-2025-68259: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68259 is a Linux kernel vulnerability in the KVM SVM (AMD Secure Virtual Machine) subsystem, specifically in the handling of soft interrupt re-injection for INT3/INTO instructions. When re-injecting a soft interrupt from an INT3, INT0, or select INTn instruction, KVM fails to verify that the correct INTn instruction was decoded when the code stream has been modified by another vCPU between execution and decoding, leading to incorrect next RIP specification and potential guest state corruption. The vulnerability was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. Feedly estimates the severity as Medium, with an EPSS score of 0.000180 (Feedly).

The root cause is a race condition (CWE-362) in the KVM SVM subsystem where the code stream can be modified by a concurrent vCPU between the time a CPU executes an INT3/INTO instruction and when KVM decodes the instruction to determine the next RIP. This is particularly relevant to Linux guests using the kernel's "text poke" code patching mechanism, which temporarily replaces the first byte of an instruction with an INT3 (opcode 0xCC) during live patching of static branches. If KVM decodes the wrong instruction due to this race — because the code has already been patched back — it specifies the wrong next RIP, effectively clobbering guest register state. The fix, referenced in upstream kernel commits (e.g., 2e84a018c289, 4da3768e1820, 54bcccc2c780, 87cc1622c88a, 53903ac9ca1a), discards the exception and retries the instruction if a code stream change is detected (Feedly).

Successful triggering of this vulnerability results in corruption of guest virtual machine state, most commonly manifesting as "Oops: int3" kernel panics in Linux guests running on AMD SVM-based hypervisors. The primary impact is on availability — affected guest VMs can crash unexpectedly during dynamic kernel patching operations such as enabling or disabling static branches (e.g., tracepoints, performance counters). There is no direct evidence of confidentiality or integrity compromise beyond the guest OS crash, and the vulnerability is confined to the guest VM context rather than enabling hypervisor escape (Feedly).

The fix has been backported to multiple Linux kernel stable branches via upstream commits (2e84a018c289, 4da3768e1820, 54bcccc2c780, 87cc1622c88a, 53903ac9ca1a). Downstream distributions have released patched packages: Ubuntu has issued advisories USN-8094-1 through USN-8094-5, USN-8152-1, USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8258-1, USN-8260-1, and USN-8265-1; Debian has issued DLA-4476-1 for the linux-6.1 package; Oracle Linux has released ELSA-2026-50112 and ELSA-2026-50271. Administrators running Linux guests on AMD SVM-based KVM hypervisors should update their host kernel packages to the latest patched versions provided by their distribution (Ubuntu USN-8094-1, Debian LTS).