CVE-2025-21779 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2025-21779?

CVE-2025-21779 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's KVM hypervisor allows a malicious guest VM to crash the host kernel when Hyper-V enlightenments are enabled without an in-kernel local APIC. This affects systems running Linux with KVM virtualization where Hyper-V features are exposed to guests. The vulnerability can lead to denial of service on the host system.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's KVM hypervisor allows a malicious guest VM to crash the host kernel when Hyper-V enlightenments are enabled without an in-kernel local APIC. This affects systems running Linux with KVM virtualization where Hyper-V features are exposed to guests. The vulnerability can lead to denial of service on the host system.

💻 Affected Systems

Products:

Linux kernel with KVM virtualization

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when Hyper-V enlightenments are exposed to guest VMs without an in-kernel local APIC. Requires KVM with specific Hyper-V configuration.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Host kernel panic leading to complete system crash and denial of service for all VMs and services running on the host.

🟠

Likely Case

Guest VM can crash the host kernel, causing downtime for all VMs on that host until the host is rebooted.

🟢

If Mitigated

No impact if Hyper-V enlightenments are disabled or if in-kernel local APIC is properly configured.

🌐 Internet-Facing: LOW - Requires access to a guest VM on the vulnerable host, not directly exploitable from the internet.

🏢 Internal Only: MEDIUM - Malicious or compromised guest VMs on the same host can exploit this to cause host downtime.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires guest VM access and specific Hyper-V configuration. The vulnerability is triggered through Hyper-V hypercalls.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 45fa526b0f5a, 5393cf223124, 61224533f2b6, 874ff13c73c4, a8de7f100bb5

Vendor Advisory: https://git.kernel.org/stable/c/45fa526b0f5a34492ed0536c3cdf88b78380e4de

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot the host system. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable Hyper-V enlightenments

linux

Prevent exposure of Hyper-V features to guest VMs

Edit VM configuration to remove Hyper-V enlightenments or set kvm.hv.enforce_cpuid=1

Ensure in-kernel local APIC

linux

Configure KVM to use in-kernel local APIC emulation

Verify KVM configuration uses kernel-mode APIC emulation

🧯 If You Can't Patch

Disable Hyper-V enlightenments on all guest VMs
Isolate potentially malicious guest VMs on separate physical hosts

🔍 How to Verify

Check if Vulnerable:

Check if running affected kernel version and if Hyper-V enlightenments are enabled without in-kernel APIC

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits and test Hyper-V hypercalls in guest VMs

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
NULL pointer dereference errors in kernel logs
KVM hypercall failure logs

Network Indicators:

Sudden loss of connectivity to host

SIEM Query:

Search for 'kasan_report', '__apic_accept_irq', or 'kvm_hv_send_ipi' in kernel logs

📊 Metadata

CVE ID: CVE-2025-21779

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.05% exploit probability (16.4th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21779, you might also want to check these: