{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38455", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.018Z", "datePublished": "2025-07-25T15:27:34.873Z", "dateUpdated": "2026-08-05T12:02:01.455Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:01.455Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight\n\nReject migration of SEV{-ES} state if either the source or destination VM\nis actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the\nsection between incrementing created_vcpus and online_vcpus. The bulk of\nvCPU creation runs _outside_ of kvm->lock to allow creating multiple vCPUs\nin parallel, and so sev_info.es_active can get toggled from false=>true in\nthe destination VM after (or during) svm_vcpu_create(), resulting in an\nSEV{-ES} VM effectively having a non-SEV{-ES} vCPU.\n\nThe issue manifests most visibly as a crash when trying to free a vCPU's\nNULL VMSA page in an SEV-ES VM, but any number of things can go wrong.\n\n BUG: unable to handle page fault for address: ffffebde00000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G U O 6.15.0-smp-DEV #2 NONE\n Tainted: [U]=USER, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]\n RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]\n RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]\n RIP: 0010:PageHead include/linux/page-flags.h:866 [inline]\n RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067\n Code: <49> f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0\n RSP: 0018:ffff8984551978d0 EFLAGS: 00010246\n RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98\n RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000\n RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000\n R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000\n R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000\n FS: 0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0\n DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Call Trace:\n \n sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169\n svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515\n kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396\n kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline]\n kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490\n kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895\n kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310\n kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369\n __fput+0x3e4/0x9e0 fs/file_table.c:465\n task_work_run+0x1a9/0x220 kernel/task_work.c:227\n exit_task_work include/linux/task_work.h:40 [inline]\n do_exit+0x7f0/0x25b0 kernel/exit.c:953\n do_group_exit+0x203/0x2d0 kernel/exit.c:1102\n get_signal+0x1357/0x1480 kernel/signal.c:3034\n arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337\n exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218\n do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f87a898e969\n \n Modules linked in: gq(O)\n gsmi: Log Shutdown Reason 0x03\n CR2: ffffebde00000000\n ---[ end trace 0000000000000000 ]---\n\nDeliberately don't check for a NULL VMSA when freeing the vCPU, as crashing\nthe host is likely desirable due to the VMSA being consumed by hardware.\nE.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a\nbogus VMSA page. Accessing P\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached exclusively through local ioctls on /dev/kvm (KVM_CREATE_VCPU on a VM fd raced against KVM_ENABLE_CAP with KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM). No network or guest-side vector exists; the migration API is host-userspace only.\nAC:L - The attacker controls both sides of the race using its own threads, and the window is very wide because the bulk of kvm_vm_ioctl_create_vcpu() (kmem_cache_zalloc, alloc_page, svm_vcpu_create with multiple page allocations) runs outside kvm->lock, so es_active can be toggled mid-creation. The attempt can be repeated indefinitely with no attacker-uncontrollable precondition; syzkaller reproduced it on a stock SEV-capable host.\nPR:L - Only an open file descriptor on /dev/kvm is required — neither sev_guest_init()/__sev_guest_init() nor kvm_vm_ioctl_enable_cap() perform any capability check, and no CAP_SYS_ADMIN or root is needed. On virtualization hosts, Android, and ChromeOS, /dev/kvm is routinely exposed to unprivileged users and sandboxed VMMs (QEMU/crosvm).\nUI:N - A single unprivileged process drives the entire sequence — create SEV-ES source VM, create destination VM, race vCPU creation against the migration ioctl, then close the fd. No action by any other user or administrator is involved.\nS:U - The attacker is host userspace and the damage lands on the host kernel, so both the vulnerable component and the impacted component are in the same security authority. This is not a guest-to-host escape — the migration ioctls are unreachable from inside a guest.\nC:H - The race produces a state confusion in which an SEV-ES VM owns a vCPU with a NULL VMSA and guest_state_protected cleared, and the fix's author explicitly notes that if VMRUN is reached hardware may read a bogus VMSA page, i.e. CPU-driven access to memory outside KVM's control. Combined with the freeing of a wild struct page pointer derived from virt_to_page(NULL), the corrupted allocator/VMSA state is leverageable for disclosure of kernel memory.\nI:H - This is a type/state confusion — a non-SEV-ES vCPU inside an SEV-ES VM — that causes __free_page() on an attacker-independent but invalid struct page, NULL-pointer writes in sev_es_sync_vmsa(), and potential hardware writes of guest state into a bogus VMSA physical page. The maintainer deliberately chose to panic rather than tolerate this precisely because continuing would mean running with corrupted state.\nA:H - The primary and reliably reproducible outcome is a host kernel oops in ___free_pages() during VM teardown (fput/task_work context), which is fatal to the process, panics with panic_on_oops, and permanently leaks the VM's SEV ASID and pinned memory. Any unprivileged /dev/kvm user can trigger it repeatedly, taking down the entire host including all co-resident guests." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/svm/sev.c" ], "versions": [ { "version": "b56639318bb2be66aceba92836279714488709b4", "lessThan": "e0d9a7cf37ca09c513420dc88e0d0e805a4f0820", "status": "affected", "versionType": "git" }, { "version": "b56639318bb2be66aceba92836279714488709b4", "lessThan": "8c8e8d4d7544bb783e15078eda8ba2580e192246", "status": "affected", "versionType": "git" }, { "version": "b56639318bb2be66aceba92836279714488709b4", "lessThan": "fd044c99d831e9f837518816c7c366b04014d405", "status": "affected", "versionType": "git" }, { "version": "b56639318bb2be66aceba92836279714488709b4", "lessThan": "b5725213149597cd9c2b075b87bc4e0f87e906c1", "status": "affected", "versionType": "git" }, { "version": "b56639318bb2be66aceba92836279714488709b4", "lessThan": "ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/svm/sev.c" ], "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.146", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.99", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.39", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.7", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.146" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.99" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.15.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e0d9a7cf37ca09c513420dc88e0d0e805a4f0820" }, { "url": "https://git.kernel.org/stable/c/8c8e8d4d7544bb783e15078eda8ba2580e192246" }, { "url": "https://git.kernel.org/stable/c/fd044c99d831e9f837518816c7c366b04014d405" }, { "url": "https://git.kernel.org/stable/c/b5725213149597cd9c2b075b87bc4e0f87e906c1" }, { "url": "https://git.kernel.org/stable/c/ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01" } ], "title": "KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:11.309Z" } } ] } }