CVE-2025-38064 (GCVE-0-2025-38064)
Vulnerability from cvelistv5
Published
2025-06-18 09:33
Modified
2026-08-05 11:59
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on device_shutdown() Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang. Invalid read at addr 0x102877002, size 2, region '(null)', reason: rejected Invalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected ... It was traced down to virtio-console. Kexec works fine if virtio-console is not in use. The issue is that virtio-console continues to write to the MMIO even after underlying virtio-pci device is reset. Additionally, Eric noticed that IOMMUs are reset before devices, if devices are not reset on shutdown they continue to poke at guest memory and get errors from the IOMMU. Some devices get wedged then. The problem can be solved by breaking all virtio devices on virtio bus shutdown, then resetting them.
References
Impacted products
Vendor Product Version
Linux Linux Version: ec3d41c4db4c21164332826ea8d812f94f2f6886
Version: ec3d41c4db4c21164332826ea8d812f94f2f6886
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aee42f3d57bfa37b2716df4584edeecf63b9df4c",
              "status": "affected",
              "version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
              "versionType": "git"
            },
            {
              "lessThan": "8bd2fa086a04886798b505f28db4002525895203",
              "status": "affected",
              "version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region \u0027(null)\u0027, reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region \u0027(null)\u0027, reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is `device_shutdown()`, reached only through local reboot/halt/kexec syscalls in `kernel/reboot.c`; no network or adjacent-network input reaches the virtio bus shutdown code. The impact lands on the local system (guest kernel), so the vector is Local.\nAC:L - The failure is deterministic rather than a race \u2014 every reboot/kexec on a system with an in-use virtio device (virtio-console, virtio-net, virtio-blk) leaves the device unquiesced, and the reporter noted kexec hangs reliably whenever virtio-console is in use. No memory-layout or timing conditions outside the attacker\u0027s control are required.\nPR:L - Although `reboot()`/`kexec_load()` nominally check `CAP_SYS_BOOT`, unprivileged local users on typical desktop, embedded and appliance deployments can initiate a system reboot or power-off through logind/polkit (and Ctrl-Alt-Del reaches `ctrl_alt_del()` with no credentials at all), so a basic local user can reach `device_shutdown()`. Choosing the higher-severity option, this is Low rather than High.\nUI:N - The reboot/kexec that triggers the unquiesced-device window is performed by the attacker themselves; no separate victim has to open a file, mount a filesystem, or take any other action.\nS:U - Both the flawed code and the damage \u2014 the hang, the stray MMIO/DMA traffic, and the corruption of the newly loaded kernel image \u2014 are confined to the same kernel/guest security authority. The virtio backend that performs the stray DMA already holds authority over that memory, so no privilege boundary is crossed.\nC:H - With virtqueues left armed and `intel_iommu_shutdown()` having already disabled translation and protected memory regions, the still-live device continues DMA *reads* from stale ring and buffer physical addresses \u2014 QEMU observed exactly this (\"Invalid read at addr 0x102877002\"). Those reads hand the contents of memory now owned by the kexec\u0027d kernel to the device backend, an unbounded kernel-memory disclosure.\nI:H - The same unreset devices continue DMA *writes* into stale buffer addresses (\"Invalid write at addr 0x102877A44\") after DMA isolation has been torn down, so a device such as virtio-net can deposit remote-attacker-supplied packet bytes into memory that the freshly loaded kernel has repurposed for its own image and data. That is arbitrary corruption of the incoming kernel, exploitable for control-flow hijack.\nA:H - The reported symptom is a hard hang of the VM on kexec \u2014 the machine never completes the boot and requires an out-of-band power cycle \u2014 and the commit further notes that devices \"get wedged\" once the IOMMU rejects their accesses. Complete loss of availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:11.657Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aee42f3d57bfa37b2716df4584edeecf63b9df4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bd2fa086a04886798b505f28db4002525895203"
        }
      ],
      "title": "virtio: break and reset virtio devices on device_shutdown()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38064",
    "datePublished": "2025-06-18T09:33:42.931Z",
    "dateReserved": "2025-04-16T04:51:23.980Z",
    "dateUpdated": "2026-08-05T11:59:11.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.