Summary
Researchers from COMSEC at ETH Zurich reported that a method, which they describe as VMSCAPE, can be used to attack Linux* userspace hypervisor software (such as QEMU) on processors1 which rely on software to mitigate Branch Target Injection (BTI).
Existing mitigations on Intel processors can be used to mitigate this issue. Intel has previously provided guidance for BTI, Branch History Injection (BHI), and Indirect Target Selection (ITS). Intel engineers worked with Linux to ensure that the appropriate mitigations for these issues as described in these guidance documents are applied to Linux userspace hypervisor software. These Linux mitigations are available for VMSCAPE, which has been assiged CVE-2025-40300.
Linux Mitigation on Different Processors
Based on our published technical guidance, Linux is implementing software solutions to address VMSCAPE for the different families of Intel processors due to architectural differences.
Note: Linux has previously implemented the branch history barrier short sequence for BHI for VM exit.
Though indirect branch predictor barrier (IBPB) is effective on all cases, alternate mitigations may provide better performance. These alternate mitigations include:
- For pre-eIBRS processors, mitigation is IBRS for userspace hypervisor. As discussed in the Hardware Features and Behavior Related to Speculative Execution article, guest predictor modes are considered less privileged than host predictor modes, so software can set IBRS to 1 prior to transitioning to host user to mitigate BTI attacks from a malicious guest.
- For eIBRS processors that are affected by ITS guest/host, mitigation is IBPB between VM exit and userspace.
- For BHI_NO = 0 and BHI_DIS_S = 1 processors, mitigation is BHB clearing sequence between VM exit and userspace.
Footnotes
- Software mitigations are for the pre-eIBRS, eIBRS processors that are affected by ITS guest/host, and eIBRS (with BHI_NO = 0 and BHI_DIS_S = 1) processors.