# CVE-2025-40181: linux: In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overri... CVE-2025-40181 is fixed in 36 products on 1 platform, first by DEBIAN-CVE-2025-40181, released November 12, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-40181 - Priority: High - CVSS: n/a (important) - EPSS: 0.0021 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Nov 12, 2025 ## Description In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forced variable MTRR range. In most KVM-based setups, legacy devices such as the HPET and TPM are enumerated via ACPI. ACPI enumeration includes a Memory32Fixed entry, and optionally a SystemMemory descriptor for an OperationRegion, e.g. if the device needs to be accessed via a Control Method. If a SystemMemory entry is present, then the kernel's ACPI driver will auto-ioremap the region so that it can be accessed at will. However, the ACPI spec doesn't provide a way to enumerate the memory type of SystemMemory regions, i.e. there's no way to tell software that a region must be mapped as UC vs. WB, etc. As a result, Linux's ACPI driver always maps SystemMemory regions using ioremap_cache(), i.e. as WB on x86. The dedicated device drivers however, e.g. the HPET driver and TPM driver, want to map their associated memory as UC or WC, as accessing PCI devices using WB is unsupported. On bare metal and non-CoCO, the conflicting requirements "work" as firmware configures the PCI hole (and other device memory) to be UC in the MTRRs. So even though the ACPI mappings request WB, they are forced to UC- in the kernel's tracking due to the kernel properly handling the MTRR overrides, and thus are compatible with the drivers' requested WC/UC-. With force WB MTRRs on SNP and TDX guests, the ACPI mappings get their requested WB if the ACPI mappings are established before the dedicated driver code attempts to initialize the device. E.g. if acpi_init() runs before the corresponding device driver is probed, ACPI's WB mapping will "win", and result in the driver's ioremap() failing because the existing WB mapping isn't compatible with the requested WC/UC-. E.g. when a TPM is emulated by the hypervisor (ignoring the security implications of relying on what is allegedly an untrusted entity to store measurements), the TPM driver will request UC and fail: [ 1.730459] ioremap error for 0xfed40000-0xfed45000, requested 0x2, got 0x0 [ 1.732780] tpm_tis MSFT0101:00: probe with driver tpm_tis failed with error -12 Note, the '0x2' and '0x0' values refer to "enum page_cache_mode", not x86's memtypes (which frustratingly are an almost pure inversion; 2 == WB, 0 == UC). E.g. tracing mapping requests for TPM TIS yields: Mapping TPM TIS with req_type = 0 WARNING: CPU: 22 PID: 1 at arch/x86/mm/pat/memtype.c:530 memtype_reserve+0x2ab/0x460 Modules linked in: CPU: 22 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.16.0-rc7+ #2 VOLUNTARY Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/29/2025 RIP: 0010:memtype_reserve+0x2ab/0x460 __ioremap_caller+0x16d/0x3d0 ioremap_cache+0x17/0x30 x86_acpi_os_ioremap+0xe/0x20 acpi_os_map_iomem+0x1f3/0x240 acpi_os_map_memory+0xe/0x20 acpi_ex_system_memory_space_handler+0x273/0x440 acpi_ev_address_space_dispatch+0x176/0x4c0 acpi_ex_access_region+0x2ad/0x530 acpi_ex_field_datum_io+0xa2/0x4f0 acpi_ex_extract_from_field+0x296/0x3e0 acpi_ex_read_data_from_field+0xd1/0x460 acpi_ex_resolve_node_to_value+0x2ee/0x530 acpi_ex_resolve_to_value+0x1f2/0x540 acpi_ds_evaluate_name_path+0x11b/0x190 acpi_ds_exec_end_op+0x456/0x960 acpi_ps_parse_loop+0x27a/0xa50 acpi_ps_parse_aml+0x226/0x600 acpi_ps_execute_method+0x172/0x3e0 acpi_ns_evaluate+0x175/0x5f0 acpi_evaluate_object+0x213/0x490 acpi_evaluate_integer+0x6d/0x140 acpi_bus_get_status+0x93/0x150 acpi_add_single_object+0x43a/0x7c0 acpi_bus_check_add+0x149/0x3a0 acpi_bus_check_add_1+0x16/0x30 acpi_ns_walk_namespace+0x22c/0x360 acpi_walk_namespace+0x15c/0x170 acpi_bus_scan+0x1dd/0x200 acpi_scan_init+0xe5/0x2b0 acpi_init+0x264/0x5b0 do_one_i ---truncated--- ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool6.12 amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | bpftool6.12-debuginfo amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.31.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.20.27.1 | [SUSE-SU-2026:0472-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0472-1.md) | Feb 12, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.31.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.31.1.150700.17.21.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.31.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-livepatch-6.12.55-74.119 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel-livepatch-SLE15-SP7-RT_Update_9 sles 15.7 | 1-150700.1.3.2 | [SUSE-SU-2026:0587-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0587-1.md) | Feb 20, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_9 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.31.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.31.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-source-azure sles 15.7 | 6.4.0-150700.20.27.1 | [SUSE-SU-2026:0472-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0472-1.md) | Feb 12, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.31.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel-syms-azure sles 15.7 | 6.4.0-150700.20.27.1 | [SUSE-SU-2026:0472-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0472-1.md) | Feb 12, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.31.1 | [SUSE-SU-2026:0447-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0447-1.md) | Feb 11, 2026 | | Linux | kernel6.12 amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-debuginfo amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-debuginfo-common-aarch64 amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-debuginfo-common-x86_64 amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-devel amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-headers amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-libbpf amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-libbpf-debuginfo amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-libbpf-devel amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-libbpf-static amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-modules-extra amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-modules-extra-common amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-tools amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-tools-debuginfo amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | kernel6.12-tools-devel amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | linux Debian 13.5 (trixie) | 6.12.57-1 | [DEBIAN-CVE-2025-40181](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40181.md) | Nov 12, 2025 | | Linux | linux Debian 14 | 6.17.6-1 | [DEBIAN-CVE-2025-40181](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40181.md) | Nov 12, 2025 | | Linux | perf6.12 amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | perf6.12-debuginfo amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | python3-perf6.12 amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | | Linux | python3-perf6.12-debuginfo amzn 2023 | 1:6.12.55-74.119.amzn2023 | [ALAS2023-2025-1316](https://patchblox.com/security/data/fix/linux/alas2023-2025-1316.md) | Dec 8, 2025 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.