Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - KVMguest_memfd當 gmem 即將停止時移除 memslot 刪除時的系結。如果從 guest_memfd 執行個體解除系結 memslot即使 guest_memfd 檔案即將停止 (即即使其檔案 refcount 已變為零)仍移除系結。如果在檔案完全釋放之前釋放 memslot則在 kvm_gmem_release() 中使系結的 memslot 端無效將會寫入已釋放的記憶體這由 syzbot+KASAN 偵測到
    ================================================== ================ 錯誤KASAN在 kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c353 在 addr ffff88807befa508 寫入大小為 8 的情況下發生平板釋放後使用task syz.0.17/6022 CPU: 0 UID: 0 PID: 6022 Comm: syz.0.17 未受污染的 syzkaller #0 PREEMPT(完整) 硬體名稱
    Google Google Compute Engine/Google Compute Engine、BIOS Google 10/02/2025 呼叫追踪 <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/ 0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 kvm_gmem_release+0x176/0x440 virt/kvm/guest_memfd.c:353 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [內嵌] exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common。 h:225 [內嵌] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [內嵌] syscall_exit_to_user_mode include/linux/entry-common.h:210 [內嵌] do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c :100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP
    0033:0x7fbeeff8efc9 </TASK> 由工作 6023 分配kasan_save_stack mm/kasan/common.c:56 [內嵌] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 Pot_kmalloc_redzone mm/kasan/common.c:397 [內嵌]
    __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414 kasan_kmalloc include/linux/kasan.h:262 [內嵌]
    __kmalloc_cache_noprof+0x3e2/0x700 mm/slub.c:5758 kmalloc_noprof include/linux/slab.h:957 [內嵌] kzalloc_noprof include/linux/slab.h:1094 [內嵌] kvm_set_memory_region+0x747/0xb90 virt/kvm/kvm_main.c :2104 kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154 kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_main.c:5201 vfs_ioctl fs/ioctl.c:51 [內嵌] __do_sys_ioctl fs/ioctl.c597 inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f已由工作 6023 釋放 kasan_save_stack mm/kasan/common.c:56 [內嵌] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584毒物_slab_object mm/kasan /common.c:252 [內嵌] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [內嵌] slab_free_hook mm/slub.c:2533 [內嵌] slab_free mm/ slub.c:6622 [內嵌] kfree+0x19a/0x6d0 mm/slub.c:6829 kvm_set_memory_region+0x9c4/0xb90 virt/kvm/kvm_main.c:2130 kvm_vm_ioctl_set_memory_region+0x6f/0xd0 virt/kvm/kvm_main.c:2154 kvm_vm_ioctl+0x957/0xc60 virt/kvm/kvm_mainct.c:io201 fs/ioctl.c:51 [內嵌] __do_sys_ioctl fs/ioctl.c:597 [內嵌] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [內嵌] do_syscall_64+ 0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f 當 f_mapping 的生命週期不在 KVM 的權限範圍內檔案快要結束時刻意不取得 filemap 無效鎖定。解除參照對應 *可能*沒有問題但是沒有必要使任何內容無效因為 memslot 刪除負責切換 SPTE而且可以存取即將停止檔案的程式碼是 kvm_gmem_release()其核心程式碼是相互的
    ---truncated--- (CVE-2025-40274)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2025-40274

high Nessus Plugin ID 277633

版本 1.1