CVE-2025-68259 Affecting rv package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CENTOS9-RV-14490746
- published18 Dec 2025
- disclosed16 Dec 2025
Introduced: 16 Dec 2025
CVE-2025-68259 (opens in a new tab)How to fix?
There is no fixed version for Centos:9 rv.
NVD Description
Note: Versions mentioned in the description apply only to the upstream rv package and not the rv package as distributed by Centos.
See How to fix? for Centos:9 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the instruction if the code stream is changed (e.g. by a different vCPU) between when the CPU executes the instruction and when KVM decodes the instruction to get the next RIP.
As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction"), failure to verify that the correct INTn instruction was decoded can effectively clobber guest state due to decoding the wrong instruction and thus specifying the wrong next RIP.
The bug most often manifests as "Oops: int3" panics on static branch checks in Linux guests. Enabling or disabling a static branch in Linux uses the kernel's "text poke" code patching mechanism. To modify code while other CPUs may be executing that code, Linux (temporarily) replaces the first byte of the original instruction with an int3 (opcode 0xcc), then patches in the new code stream except for the first byte, and finally replaces the int3 with the first byte of the new code stream. If a CPU hits the int3, i.e. executes the code while it's being modified, then the guest kernel must look up the RIP to determine how to handle the #BP, e.g. by emulating the new instruction. If the RIP is incorrect, then this lookup fails and the guest kernel panics.
The bug reproduces almost instantly by hacking the guest kernel to repeatedly check a static branch1 while running a drgn script2 on the host to constantly swap out the memory containing the guest's TSS.
References
- https://access.redhat.com/security/cve/CVE-2025-68259
- https://git.kernel.org/stable/c/4da3768e1820cf15cced390242d8789aed34f54d
- https://git.kernel.org/stable/c/53903ac9ca1abffa27327e85075ec496fa55ccf3
- https://git.kernel.org/stable/c/54bcccc2c7805a00af1d7d2faffd6f424c0133aa
- https://git.kernel.org/stable/c/87cc1622c88a4888959d64fa1fc9ba1e264aa3d4
- https://git.kernel.org/stable/c/152289a51107ef45bbfe9b4aeeaa584a503042b5
- https://git.kernel.org/stable/c/2e84a018c2895c05abe213eb10db128aa45f6ec6