CVE-2025-38064
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's virtio subsystem, specifically with virtio-console. The issue is that virtio-console continues to write to memory-mapped I/O (MMIO) even after the underlying virtio-pci device has been reset during device shutdown. This causes invalid memory accesses and can lead to system hangs, particularly during kexec in virtual machines. The root cause is that devices are not properly broken and reset on shutdown, allowing them to continue accessing guest memory incorrectly.
How can this vulnerability impact me? :
This vulnerability can cause system hangs and instability in virtual machines using virtio-console, especially during kexec operations. It can lead to invalid memory accesses and errors from the IOMMU, potentially causing devices to become wedged and unresponsive. This can disrupt normal operation and affect the reliability of virtualized environments.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability can be mitigated by ensuring that all virtio devices are properly broken and reset on virtio bus shutdown. Specifically, avoid using virtio-console if possible until the fix is applied, as virtio-console continues to write to MMIO after the underlying virtio-pci device is reset, causing invalid memory accesses. Applying the patch or update that breaks and resets virtio devices on device_shutdown() will resolve the issue.