CVE-2025-38508
BaseFortify
Publication date: 2025-08-16
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a timing discrepancy in Linux kernel's handling of Secure TSC frequency for SEV-SNP virtual machines. The GUEST_TSC_FREQ MSR reports a nominal CPU frequency that slightly deviates from the actual mean TSC frequency. Over time, this causes clock skew between the hypervisor and the VM, leading to early timer interrupts perceived by the guest. The guest kernel relies on the nominal frequency for timekeeping, but the actual frequency differs, causing inaccurate time calculations and premature firing of high-resolution timers. The fix uses the TSC_FACTOR from the SEV firmware's secrets page to calculate the mean TSC frequency accurately, mitigating clock skew.
How can this vulnerability impact me? :
This vulnerability can cause inaccurate timekeeping within SEV-SNP virtual machines, leading to clock skew and early timer interrupts. This may affect time-sensitive applications running inside the VM, potentially causing unexpected behavior, performance issues, or errors related to timing.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the Linux kernel uses the TSC_FACTOR from the SEV firmware's secrets page to calculate the mean TSC frequency for accurate timekeeping in SEV-SNP VMs. Additionally, use early_ioremap_encrypted() to map the secrets page during early TSC initialization instead of ioremap_encrypted(), which can cause a panic due to kmalloc() unavailability.