Linux Kernel CVE-2025-40051

Upstream fix available (multiple stable-tree commits); a released patched tag is not independently confirmed from the provided data - update to the kernel build from your distribution that incorporates the vringh return-value fix (commits 78dc7362, 82a8d0fd, baa37b1c, cfa06544, db042925 at https://git.kernel.org/stable/c/). Because the fix is a small correctness change with no documented feature-level workaround, the primary compensating control until patching is to reduce exposure of the vulnerable code path: avoid loading/using vhost, vringh and vDPA backends on hosts that do not require them (e.g., do not attach untrusted guests to vDPA/vhost devices), and restrict which local users and guests can access /dev/vhost-* and vDPA management interfaces. The trade-off is that disabling vhost/vDPA degrades para-virtualized I/O performance for VMs, so it is only viable where those backends are unused.