Junglewise Threat Intelligence

CVE-2025-71104: Linux Kernel KVM hard lockup in x86 APIC periodic timer

CVE-2025-71104 · Severity: medium · CVSS 5.5 · Published 2026-01-14

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's virtualization component (KVM) can cause the host computer to freeze or crash when a virtual machine is resumed after a long period of inactivity. This occurs because the system attempts to process a massive backlog of missed timer events all at once, overwhelming the processor. An attacker with access to a virtual machine could potentially trigger this condition to cause a denial-of-service on the physical host server.

Technical details

A vulnerability in KVM's x86 LAPIC implementation occurs when advancing the target expiration for a guest's APIC timer in periodic mode. When a VM is paused or suspended for an extended duration, the target expiration falls significantly behind the current time. Upon resumption, KVM may calculate a negative delta that overflows the VMX Preemption Timer (HV timer), causing a fallback to software hrtimers. Because hrtimers execute with interrupts disabled and immediately re-invoke the callback for past-due expirations, the host can enter an infinite loop of IRQs, resulting in a hard lockup. The fix ensures that if a target expiration is in the past, it is forced to 'now' rather than attempting to catch up on missed periods.

Affected products

  • Linux Linux Kernel Fixed in 6.1.125, 6.6.72, 6.12.10, 6.13.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later

Timeline

  • 2025-11-13: disclosed: Initial patch submission
  • 2026-01-14: advisory: CVE published
  • 2026-01-19: patched: Stable kernel backports committed

References

Related threats