Processor vulnerability
CVE-2025-40300
Branch predictions a guest leaves behind are not cleared before the host returns to its user-space hypervisor, which the guest can so attack.
- Name
- VMSCAPE
- Also known as
- VMSCAPE
- Kind
- Transient execution
- CVE published
- 2025-09-11 CVE record
- Linux reports it in
vmscape
Spectre variant 2 mitigations isolate processes at context switch,
but after a VM exit the host can return to its user-space VMM, such
as QEMU, without a context switch, so predictions trained by the
guest are still in place. Even if the VMM holds no secrets, the
guest’s user space can use it against the guest’s own kernel. Linux
lists the Skylake generation without enhanced IBRS, Cascade Lake
parts affected by ITS, Alder Lake and later (those affected by BHI),
AMD Zen families 17h, 19h and 1Ah, and Hygon family 18h.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
30 of the 30 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Sandy Bridge | Affected | Linux 7.3 lists INTEL_SANDYBRIDGE, INTEL_SANDYBRIDGE_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Ivy Bridge | Affected | Linux 7.3 lists INTEL_IVYBRIDGE, INTEL_IVYBRIDGE_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Haswell | Affected | Linux 7.3 lists INTEL_HASWELL, INTEL_HASWELL_G, INTEL_HASWELL_L, INTEL_HASWELL_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Broadwell | Affected | Linux 7.3 lists INTEL_BROADWELL, INTEL_BROADWELL_D, INTEL_BROADWELL_G, INTEL_BROADWELL_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Skylake | Affected | Linux 7.3 lists INTEL_SKYLAKE, INTEL_SKYLAKE_L in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Kaby Lake | Affected | Linux 7.3 lists INTEL_KABYLAKE stepping 9, INTEL_KABYLAKE_L steppings 9 to 12 in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Coffee Lake | Affected | Linux 7.3 lists INTEL_KABYLAKE steppings 10 to 13, INTEL_KABYLAKE_L steppings 10 to 12 in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Cannon Lake | Affected | Linux 7.3 lists INTEL_CANNONLAKE_L in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Comet Lake | Affected | Linux 7.3 lists INTEL_COMETLAKE, INTEL_COMETLAKE_L, INTEL_KABYLAKE_L stepping 12 in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Alder Lake | Affected | Linux 7.3 lists INTEL_ALDERLAKE, INTEL_ALDERLAKE_L in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Raptor Lake | Affected | Linux 7.3 lists INTEL_RAPTORLAKE, INTEL_RAPTORLAKE_P, INTEL_RAPTORLAKE_S in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Arrow Lake | Affected | Linux 7.3 lists INTEL_ARROWLAKE, INTEL_ARROWLAKE_H, INTEL_ARROWLAKE_U in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Lunar Lake | Affected | Linux 7.3 lists INTEL_LUNARLAKE_M in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Skylake-SP | Affected | Linux 7.3 lists INTEL_SKYLAKE_X steppings 3 to 4 in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Cascade Lake | Affected | Linux 7.3 lists INTEL_SKYLAKE_X steppings 5 to 7 in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Cooper Lake | Affected | Linux 7.3 lists INTEL_SKYLAKE_X stepping 11 in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Emerald Rapids | Affected | Linux 7.3 lists INTEL_EMERALDRAPIDS_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Sapphire Rapids | Affected | Linux 7.3 lists INTEL_SAPPHIRERAPIDS_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Sierra Forest | Affected | Linux 7.3 lists INTEL_ATOM_CRESTMONT_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Gracemont | Affected | Linux 7.3 lists INTEL_ATOM_GRACEMONT in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Zen | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Zen+ | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Zen 2 | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Zen 3 | Affected | Linux 7.3 lists AMD family 19h in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Zen 4 | Affected | Linux 7.3 lists AMD family 19h in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Zen 5 | Affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Zen 6 | Affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Dhyana | Affected | Linux 7.3 lists Hygon family 18h in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Meteor Lake | Some models | Linux 7.3 lists INTEL_METEORLAKE_L in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
| Granite Rapids | Some models | Linux 7.3 lists INTEL_GRANITERAPIDS_X in cpu_vuln_blacklist with VMSCAPE | Linux 7.3 |
Mitigations
- Kernel: Linux issues an IBPB before the first return to user space after a VM exit, and only if user space has not run since the exit. With SMT on, STIBP is also needed. Instructions: WRMSR. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/vmscape holds one of these lines:
Not affectedVulnerableMitigation: IBPB before exit to userspaceMitigation: IBPB on VMEXIT