CVE-2025-23135 is a vulnerability identified in the Linux kernel specifically affecting the RISC-V architecture's Kernel-based Virtual Machine (KVM) module. The issue arises during the teardown process of the KVM module, where the sequence of cleanup operations is incorrect. Specifically, the kernel invokes the architecture-specific disable call (which disables the Advanced Interrupt Architecture - AIA) after calling aia_exit, leading to an inconsistent state of the interrupt request (IRQ) system. This inconsistency manifests as warnings about percpu IRQs still being enabled on CPUs after module removal, and critically, it prevents the KVM kernel module from being reinserted due to the IRQ subsystem being left in an inconsistent state. The root cause is that aia_exit is called before kvm_exit, whereas the correct order should be to invoke aia_exit and other architecture-specific cleanup functions after kvm_exit. This sequencing ensures that the disable function is called first, properly disabling AIA before the exit routines proceed. The vulnerability is specific to the RISC-V architecture implementation of KVM within the Linux kernel and affects kernel versions around 6.14.0-rc5. While the vulnerability does not appear to be exploitable remotely or by unprivileged users, it impacts the stability and reliability of the KVM module on affected systems, potentially causing denial of service conditions due to module insertion failures and IRQ inconsistencies. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations utilizing Linux systems on RISC-V architectures with KVM virtualization, this vulnerability could disrupt virtualization operations by preventing the KVM module from being reloaded after removal. This can lead to system instability, denial of service for virtualized workloads, and increased downtime during maintenance or updates involving KVM modules. Organizations relying on RISC-V based virtualization for development, testing, or production workloads may face operational challenges. Although the vulnerability does not directly lead to privilege escalation or remote code execution, the inability to properly manage KVM modules can impact availability and reliability of critical services. Given the emerging adoption of RISC-V in certain European research institutions and technology companies, the impact is more pronounced in environments where RISC-V virtualization is actively used. The vulnerability may also complicate kernel module management and debugging efforts, increasing operational overhead and risk of misconfiguration.

To mitigate CVE-2025-23135, European organizations should: 1) Apply the official Linux kernel patch that corrects the order of cleanup calls in the KVM RISC-V module teardown process as soon as it becomes available from trusted Linux kernel sources or distributions. 2) Avoid removing and reinserting the KVM module on affected RISC-V systems until patched, to prevent encountering the inconsistent IRQ state. 3) For environments requiring module reloads, consider rebooting the system as a temporary workaround to reset IRQ states. 4) Monitor kernel logs for warnings related to percpu IRQs and KVM module insertion failures to detect potential issues early. 5) Engage with Linux distribution vendors to ensure timely updates and backports of the fix for enterprise kernels. 6) For critical production systems, test kernel updates in staging environments to validate the fix and ensure no regression in virtualization stability. 7) Maintain robust backup and recovery procedures to minimize downtime if module issues cause service disruptions. These steps go beyond generic advice by focusing on the specific module management and kernel update practices relevant to this vulnerability.