CVE-2025-38455 (GCVE-0-2025-38455)

Vulnerability from cvelistv5 – Published: 2025-07-25 15:27 – Updated: 2026-08-05 12:02
VLAI
Title
KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight Reject migration of SEV{-ES} state if either the source or destination VM is actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the section between incrementing created_vcpus and online_vcpus. The bulk of vCPU creation runs _outside_ of kvm->lock to allow creating multiple vCPUs in parallel, and so sev_info.es_active can get toggled from false=>true in the destination VM after (or during) svm_vcpu_create(), resulting in an SEV{-ES} VM effectively having a non-SEV{-ES} vCPU. The issue manifests most visibly as a crash when trying to free a vCPU's NULL VMSA page in an SEV-ES VM, but any number of things can go wrong. BUG: unable to handle page fault for address: ffffebde00000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G U O 6.15.0-smp-DEV #2 NONE Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] RIP: 0010:PageHead include/linux/page-flags.h:866 [inline] RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067 Code: <49> f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0 RSP: 0018:ffff8984551978d0 EFLAGS: 00010246 RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000 RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000 R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000 R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000 FS: 0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169 svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515 kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396 kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline] kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490 kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895 kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310 kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369 __fput+0x3e4/0x9e0 fs/file_table.c:465 task_work_run+0x1a9/0x220 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x7f0/0x25b0 kernel/exit.c:953 do_group_exit+0x203/0x2d0 kernel/exit.c:1102 get_signal+0x1357/0x1480 kernel/signal.c:3034 arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218 do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f87a898e969 </TASK> Modules linked in: gq(O) gsmi: Log Shutdown Reason 0x03 CR2: ffffebde00000000 ---[ end trace 0000000000000000 ]--- Deliberately don't check for a NULL VMSA when freeing the vCPU, as crashing the host is likely desirable due to the VMSA being consumed by hardware. E.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a bogus VMSA page. Accessing P ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b56639318bb2be66aceba92836279714488709b4 , < e0d9a7cf37ca09c513420dc88e0d0e805a4f0820 (git)
Affected: b56639318bb2be66aceba92836279714488709b4 , < 8c8e8d4d7544bb783e15078eda8ba2580e192246 (git)
Affected: b56639318bb2be66aceba92836279714488709b4 , < fd044c99d831e9f837518816c7c366b04014d405 (git)
Affected: b56639318bb2be66aceba92836279714488709b4 , < b5725213149597cd9c2b075b87bc4e0f87e906c1 (git)
Affected: b56639318bb2be66aceba92836279714488709b4 , < ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01 (git)
Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.146 , ≤ 6.1.* (semver)
Unaffected: 6.6.99 , ≤ 6.6.* (semver)
Unaffected: 6.12.39 , ≤ 6.12.* (semver)
Unaffected: 6.15.7 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:11.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e0d9a7cf37ca09c513420dc88e0d0e805a4f0820",
              "status": "affected",
              "version": "b56639318bb2be66aceba92836279714488709b4",
              "versionType": "git"
            },
            {
              "lessThan": "8c8e8d4d7544bb783e15078eda8ba2580e192246",
              "status": "affected",
              "version": "b56639318bb2be66aceba92836279714488709b4",
              "versionType": "git"
            },
            {
              "lessThan": "fd044c99d831e9f837518816c7c366b04014d405",
              "status": "affected",
              "version": "b56639318bb2be66aceba92836279714488709b4",
              "versionType": "git"
            },
            {
              "lessThan": "b5725213149597cd9c2b075b87bc4e0f87e906c1",
              "status": "affected",
              "version": "b56639318bb2be66aceba92836279714488709b4",
              "versionType": "git"
            },
            {
              "lessThan": "ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01",
              "status": "affected",
              "version": "b56639318bb2be66aceba92836279714488709b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight\n\nReject migration of SEV{-ES} state if either the source or destination VM\nis actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the\nsection between incrementing created_vcpus and online_vcpus.  The bulk of\nvCPU creation runs _outside_ of kvm-\u003elock to allow creating multiple vCPUs\nin parallel, and so sev_info.es_active can get toggled from false=\u003etrue in\nthe destination VM after (or during) svm_vcpu_create(), resulting in an\nSEV{-ES} VM effectively having a non-SEV{-ES} vCPU.\n\nThe issue manifests most visibly as a crash when trying to free a vCPU\u0027s\nNULL VMSA page in an SEV-ES VM, but any number of things can go wrong.\n\n  BUG: unable to handle page fault for address: ffffebde00000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G     U     O        6.15.0-smp-DEV #2 NONE\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n  RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]\n  RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]\n  RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]\n  RIP: 0010:PageHead include/linux/page-flags.h:866 [inline]\n  RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067\n  Code: \u003c49\u003e f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0\n  RSP: 0018:ffff8984551978d0 EFLAGS: 00010246\n  RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98\n  RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000\n  RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000\n  R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000\n  R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000\n  FS:  0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0\n  DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u003cTASK\u003e\n   sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169\n   svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515\n   kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396\n   kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline]\n   kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490\n   kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895\n   kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310\n   kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369\n   __fput+0x3e4/0x9e0 fs/file_table.c:465\n   task_work_run+0x1a9/0x220 kernel/task_work.c:227\n   exit_task_work include/linux/task_work.h:40 [inline]\n   do_exit+0x7f0/0x25b0 kernel/exit.c:953\n   do_group_exit+0x203/0x2d0 kernel/exit.c:1102\n   get_signal+0x1357/0x1480 kernel/signal.c:3034\n   arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n   syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218\n   do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7f87a898e969\n   \u003c/TASK\u003e\n  Modules linked in: gq(O)\n  gsmi: Log Shutdown Reason 0x03\n  CR2: ffffebde00000000\n  ---[ end trace 0000000000000000 ]---\n\nDeliberately don\u0027t check for a NULL VMSA when freeing the vCPU, as crashing\nthe host is likely desirable due to the VMSA being consumed by hardware.\nE.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a\nbogus VMSA page.  Accessing P\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through local ioctls on /dev/kvm (KVM_CREATE_VCPU on a VM fd raced against KVM_ENABLE_CAP with KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM). No network or guest-side vector exists; the migration API is host-userspace only.\nAC:L - The attacker controls both sides of the race using its own threads, and the window is very wide because the bulk of kvm_vm_ioctl_create_vcpu() (kmem_cache_zalloc, alloc_page, svm_vcpu_create with multiple page allocations) runs outside kvm-\u003elock, so es_active can be toggled mid-creation. The attempt can be repeated indefinitely with no attacker-uncontrollable precondition; syzkaller reproduced it on a stock SEV-capable host.\nPR:L - Only an open file descriptor on /dev/kvm is required \u2014 neither sev_guest_init()/__sev_guest_init() nor kvm_vm_ioctl_enable_cap() perform any capability check, and no CAP_SYS_ADMIN or root is needed. On virtualization hosts, Android, and ChromeOS, /dev/kvm is routinely exposed to unprivileged users and sandboxed VMMs (QEMU/crosvm).\nUI:N - A single unprivileged process drives the entire sequence \u2014 create SEV-ES source VM, create destination VM, race vCPU creation against the migration ioctl, then close the fd. No action by any other user or administrator is involved.\nS:U - The attacker is host userspace and the damage lands on the host kernel, so both the vulnerable component and the impacted component are in the same security authority. This is not a guest-to-host escape \u2014 the migration ioctls are unreachable from inside a guest.\nC:H - The race produces a state confusion in which an SEV-ES VM owns a vCPU with a NULL VMSA and guest_state_protected cleared, and the fix\u0027s author explicitly notes that if VMRUN is reached hardware may read a bogus VMSA page, i.e. CPU-driven access to memory outside KVM\u0027s control. Combined with the freeing of a wild struct page pointer derived from virt_to_page(NULL), the corrupted allocator/VMSA state is leverageable for disclosure of kernel memory.\nI:H - This is a type/state confusion \u2014 a non-SEV-ES vCPU inside an SEV-ES VM \u2014 that causes __free_page() on an attacker-independent but invalid struct page, NULL-pointer writes in sev_es_sync_vmsa(), and potential hardware writes of guest state into a bogus VMSA physical page. The maintainer deliberately chose to panic rather than tolerate this precisely because continuing would mean running with corrupted state.\nA:H - The primary and reliably reproducible outcome is a host kernel oops in ___free_pages() during VM teardown (fput/task_work context), which is fatal to the process, panics with panic_on_oops, and permanently leaks the VM\u0027s SEV ASID and pinned memory. Any unprivileged /dev/kvm user can trigger it repeatedly, taking down the entire host including all co-resident guests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:01.455Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e0d9a7cf37ca09c513420dc88e0d0e805a4f0820"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c8e8d4d7544bb783e15078eda8ba2580e192246"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd044c99d831e9f837518816c7c366b04014d405"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5725213149597cd9c2b075b87bc4e0f87e906c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01"
        }
      ],
      "title": "KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38455",
    "datePublished": "2025-07-25T15:27:34.873Z",
    "dateReserved": "2025-04-16T04:51:24.018Z",
    "dateUpdated": "2026-08-05T12:02:01.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38455",
      "date": "2026-08-11",
      "epss": "0.00156",
      "percentile": "0.05268"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38455\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T16:15:31.143\",\"lastModified\":\"2026-07-30T06:23:15.173\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight\\n\\nReject migration of SEV{-ES} state if either the source or destination VM\\nis actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the\\nsection between incrementing created_vcpus and online_vcpus.  The bulk of\\nvCPU creation runs _outside_ of kvm-\u003elock to allow creating multiple vCPUs\\nin parallel, and so sev_info.es_active can get toggled from false=\u003etrue in\\nthe destination VM after (or during) svm_vcpu_create(), resulting in an\\nSEV{-ES} VM effectively having a non-SEV{-ES} vCPU.\\n\\nThe issue manifests most visibly as a crash when trying to free a vCPU\u0027s\\nNULL VMSA page in an SEV-ES VM, but any number of things can go wrong.\\n\\n  BUG: unable to handle page fault for address: ffffebde00000000\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\\n  CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G     U     O        6.15.0-smp-DEV #2 NONE\\n  Tainted: [U]=USER, [O]=OOT_MODULE\\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\\n  RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]\\n  RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]\\n  RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]\\n  RIP: 0010:PageHead include/linux/page-flags.h:866 [inline]\\n  RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067\\n  Code: \u003c49\u003e f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0\\n  RSP: 0018:ffff8984551978d0 EFLAGS: 00010246\\n  RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98\\n  RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000\\n  RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000\\n  R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000\\n  R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000\\n  FS:  0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0\\n  DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\\n  Call Trace:\\n   \u003cTASK\u003e\\n   sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169\\n   svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515\\n   kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396\\n   kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline]\\n   kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490\\n   kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895\\n   kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310\\n   kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369\\n   __fput+0x3e4/0x9e0 fs/file_table.c:465\\n   task_work_run+0x1a9/0x220 kernel/task_work.c:227\\n   exit_task_work include/linux/task_work.h:40 [inline]\\n   do_exit+0x7f0/0x25b0 kernel/exit.c:953\\n   do_group_exit+0x203/0x2d0 kernel/exit.c:1102\\n   get_signal+0x1357/0x1480 kernel/signal.c:3034\\n   arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337\\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\\n   syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218\\n   do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n  RIP: 0033:0x7f87a898e969\\n   \u003c/TASK\u003e\\n  Modules linked in: gq(O)\\n  gsmi: Log Shutdown Reason 0x03\\n  CR2: ffffebde00000000\\n  ---[ end trace 0000000000000000 ]---\\n\\nDeliberately don\u0027t check for a NULL VMSA when freeing the vCPU, as crashing\\nthe host is likely desirable due to the VMSA being consumed by hardware.\\nE.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a\\nbogus VMSA page.  Accessing P\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: SVM: Rechazar la migraci\u00f3n intrahost de SEV{-ES} si la creaci\u00f3n de vCPU est\u00e1 en vuelo Rechazar la migraci\u00f3n del estado SEV{-ES} si la VM de origen o de destino est\u00e1 creando activamente una vCPU, es decir, si kvm_vm_ioctl_create_vcpu() est\u00e1 en la secci\u00f3n entre el incremento de created_vcpus y online_vcpus. La mayor parte de la creaci\u00f3n de vCPU se ejecuta _fuera_ de kvm-\u0026gt;lock para permitir la creaci\u00f3n de m\u00faltiples vCPU en paralelo, y por lo tanto sev_info.es_active puede alternarse de false=\u0026gt;true en la VM de destino despu\u00e9s (o durante) svm_vcpu_create(), lo que resulta en que una VM SEV{-ES} tenga efectivamente una vCPU que no es SEV{-ES}. El problema se manifiesta de forma m\u00e1s visible como un bloqueo al intentar liberar una p\u00e1gina VMSA NULL de una vCPU en una VM SEV-ES, pero hay muchas cosas que pueden salir mal. BUG: unable to handle page fault for address: ffffebde00000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G U O 6.15.0-smp-DEV #2 NONE Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline] RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline] RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline] RIP: 0010:PageHead include/linux/page-flags.h:866 [inline] RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067 Code: \u0026lt;49\u0026gt; f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0 RSP: 0018:ffff8984551978d0 EFLAGS: 00010246 RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000 RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000 R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000 R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000 FS: 0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace:  sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169 svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515 kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396 kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline] kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490 kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895 kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310 kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369 __fput+0x3e4/0x9e0 fs/file_table.c:465 task_work_run+0x1a9/0x220 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x7f0/0x25b0 kernel/exit.c:953 do_group_exit+0x203/0x2d0 kernel/exit.c:1102 get_signal+0x1357/0x1480 kernel/signal.c:3034 arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218 do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f87a898e969  Modules linked in: gq(O) gsmi: Log Shutdown Reason 0x03 CR2: ffffebde00000000 ---[ end trace 0000000000000000 ]--- Deliberately don\u0027t check for a NULL VMSA when freeing the vCPU, as crashing the host is likely desirable due to the VMSA being consumed by hardware. E.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a bogus VMSA page. Accessing P ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b56639318bb2be66aceba92836279714488709b4\",\"lessThan\":\"e0d9a7cf37ca09c513420dc88e0d0e805a4f0820\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b56639318bb2be66aceba92836279714488709b4\",\"lessThan\":\"8c8e8d4d7544bb783e15078eda8ba2580e192246\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b56639318bb2be66aceba92836279714488709b4\",\"lessThan\":\"fd044c99d831e9f837518816c7c366b04014d405\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b56639318bb2be66aceba92836279714488709b4\",\"lessThan\":\"b5725213149597cd9c2b075b87bc4e0f87e906c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b56639318bb2be66aceba92836279714488709b4\",\"lessThan\":\"ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kvm/svm/sev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.146\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.99\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.39\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.7\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.146\",\"matchCriteriaId\":\"D8DA1166-5C95-475E-BF65-1DF621968E96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.99\",\"matchCriteriaId\":\"B369699C-E0E6-42A4-BDEE-8E676ECEF6AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.39\",\"matchCriteriaId\":\"18D57670-11F8-4B5A-AD56-EA32DD0F44E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.7\",\"matchCriteriaId\":\"F9C46937-5FA9-4335-AD7B-E7FC29453CE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8c8e8d4d7544bb783e15078eda8ba2580e192246\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5725213149597cd9c2b075b87bc4e0f87e906c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e0d9a7cf37ca09c513420dc88e0d0e805a4f0820\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fd044c99d831e9f837518816c7c366b04014d405\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:08:58+00:00",
      "cve": "CVE-2025-38455",
      "id": "CVE-2025-38455",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38455.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:46:05Z",
      "cve": "CVE-2025-38455",
      "id": "CVE-2025-38455",
      "initial_release_date": "2025-07-25T23:22:53Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "567",
      "product_status:known_not_affected": "150",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38455",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38455.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.