{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38314", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.003Z", "datePublished": "2025-07-10T07:42:21.937Z", "dateUpdated": "2026-08-05T12:01:06.485Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:06.485Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-pci: Fix result size returned for the admin command completion\n\nThe result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes\nlarger than the actual result data size. This occurs because the\nresult_sg_size field of the command is filled with the result length\nfrom virtqueue_get_buf(), which includes both the data size and an\nadditional 8 bytes of status.\n\nThis oversized result size causes two issues:\n1. The state transferred to the destination includes 8 bytes of extra\n data at the end.\n2. The allocated buffer in the kernel may be smaller than the returned\n size, leading to failures when reading beyond the allocated size.\n\nThe commit fixes this by subtracting the status size from the result of\nvirtqueue_get_buf().\n\nThis fix has been tested through live migrations with virtio-net,\nvirtio-net-transitional, and virtio-blk devices." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The buggy completion handler is only driven by admin-vq commands issued from the virtio VFIO variant driver, reached through local `VFIO_DEVICE_FEATURE` migration-state ioctls and `read()` on the migration anon-inode fd. Nothing on the path processes remote or guest-supplied input, so the attacker needs local access to the host's VFIO device node.\nAC:L - The off-by-8 is unconditional — every `virtio_pci_admin_dev_parts_get()` completion returns `len` including the status SG, so the attacker simply performs a normal STOP_COPY/PRE_COPY save and reads the fd. There is no race, no timing window, and no dependence on memory layout the attacker cannot influence.\nPR:L - Neither `virtiovf_pci_set_device_state()` nor the save-fd `read()` path performs any capability check; access is gated only by permissions on the VFIO device/group node, which in the standard libvirt/QEMU model are delegated to an unprivileged VMM user. That is low privilege, not genuine host root.\nUI:N - The attacker drives the migration state transition and reads the migration file descriptor entirely on their own. No victim action, cooperation, or pre-existing migration in progress is required.\nS:U - The disclosed data and the failing operation both belong to the host kernel's own security authority, with the leak flowing to the same userspace process that already owns the VFIO device. No VM, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - Because the migration buffer pages are allocated via `alloc_pages_bulk()` without `__GFP_ZERO`, the 8 bytes past the device-written data are stale kernel page contents that `virtiovf_buf_read()` copies to userspace and that are then transmitted off-host to the migration destination. Each save/precopy cycle allocates fresh pages, so the leak can be harvested repeatedly to sample arbitrary previously-freed memory — kernel pointers, page-cache contents, or other tenants' data.\nI:L - The inflated size propagates into `virtiovf_add_buf_header()`, so the record written into the migration stream is 8 bytes too long and the destination feeds a corrupted device-parts blob to `virtio_pci_admin_dev_parts_set()`, modifying the migrated guest's device state. There is no out-of-bounds or attacker-controlled write in kernel memory, so the modification is bounded.\nA:H - Whenever the device-parts size is page-aligned, `res_size` exceeds `buf->allocated_length` and `virtiovf_get_migration_page()` returns NULL, making every `read()` on the migration fd fail with `-EINVAL` and aborting live migration for that device outright. Combined with the malformed state blob, the migrated guest's virtio device cannot be restored on the destination, denying availability of the workload being migrated." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/virtio/virtio_pci_modern.c" ], "versions": [ { "version": "704806ca400e5daa86c110f14bfdda9d28203bb7", "lessThan": "920b6720bb63893b81516c0c45884a8350f9e4bf", "status": "affected", "versionType": "git" }, { "version": "704806ca400e5daa86c110f14bfdda9d28203bb7", "lessThan": "9ef41ebf787fcbde99ac404ae473f8467641f983", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/virtio/virtio_pci_modern.c" ], "versions": [ { "version": "6.13", "status": "affected" }, { "version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.15.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf" }, { "url": "https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983" } ], "title": "virtio-pci: Fix result size returned for the admin command completion", "x_generator": { "engine": "bippy-1.2.0" } } } }