CVE-2025-21779 is a vulnerability identified in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically affecting the handling of Hyper-V hypercalls related to inter-processor interrupts (IPIs) on x86 architectures. The vulnerability arises from improper validation of SEND_IPI and SEND_IPI_EX hypercalls when the local Advanced Programmable Interrupt Controller (APIC) is not managed within the kernel but instead emulated in userspace. The Linux kernel incorrectly advertises support for these Hyper-V hypercalls regardless of whether the local APIC is in-kernel or userspace-emulated. This leads to a scenario where SEND_IPI hypercalls can be accepted without proper kernel-side APIC emulation, resulting in a NULL-pointer dereference and consequent kernel crash or denial of service. The vulnerability is triggered when a guest virtual machine running under KVM with Hyper-V enlightenments attempts to send IPIs, but the local APIC is not handled by the kernel. The fix involves rejecting SEND_IPI and SEND_IPI_EX hypercalls unless the local APIC is emulated by KVM in the kernel, thereby preventing reliance on userspace to enforce capability opt-in. The technical call stack indicates the crash occurs during the handling of these hypercalls, involving kernel address sanitizer (KASAN) reports and APIC interrupt acceptance routines. Since the per-VM irqchip_mode is immutable after vCPU creation, checking the sending vCPU's APIC mode suffices for enforcement. This vulnerability affects Linux kernel versions identified by the commit hash 214ff83d4473a7757fa18a64dc7efe3b0e158486 and was published on February 27, 2025. No known exploits are reported in the wild as of publication.

For European organizations, the impact of CVE-2025-21779 primarily concerns environments utilizing KVM virtualization with Hyper-V enlightenments on x86 platforms. Organizations running Linux-based virtualized infrastructure, especially those leveraging mixed virtualization technologies or nested virtualization scenarios involving Hyper-V features, may experience denial of service conditions due to kernel crashes triggered by this vulnerability. This could disrupt critical services, cloud workloads, or virtualized applications, impacting availability. Confidentiality and integrity impacts are less direct since the vulnerability leads to a NULL-pointer dereference rather than arbitrary code execution. However, repeated crashes could be exploited to cause operational disruptions or trigger failover mechanisms, potentially exposing other attack surfaces. European data centers, cloud providers, and enterprises with hybrid virtualization stacks are at risk of service interruptions if unpatched. Given the Linux kernel's widespread use in European IT infrastructure, the vulnerability's scope is broad, but exploitation requires specific virtualization configurations, limiting the attack surface. The absence of known exploits reduces immediate risk, but the vulnerability's presence in kernel virtualization code warrants prompt attention to prevent future exploitation attempts.

To mitigate CVE-2025-21779, European organizations should: 1) Apply the latest Linux kernel patches that explicitly reject SEND_IPI and SEND_IPI_EX hypercalls when the local APIC is not in-kernel, ensuring the fix is included in their kernel versions. 2) Audit virtualization configurations to identify KVM guests using Hyper-V enlightenments and verify the local APIC emulation mode. 3) Avoid relying on userspace APIC emulation for workloads that require Hyper-V hypercall support; instead, ensure in-kernel APIC handling is enabled. 4) Implement monitoring for kernel oops or crash logs related to KVM hypercall handling to detect potential exploitation attempts or misconfigurations. 5) For critical production environments, consider isolating or restricting virtual machines that might trigger this vulnerability until patches are applied. 6) Coordinate with Linux distribution vendors and virtualization platform providers to confirm patch availability and deployment timelines. 7) Incorporate this vulnerability into vulnerability management and incident response plans to ensure rapid remediation and detection.