CVE-2025-38064

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
18/06/2025
Last modified:
14/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virtio: break and reset virtio devices on device_shutdown()<br /> <br /> Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory<br /> accesses during the hang.<br /> <br /> Invalid read at addr 0x102877002, size 2, region &amp;#39;(null)&amp;#39;, reason: rejected<br /> Invalid write at addr 0x102877A44, size 2, region &amp;#39;(null)&amp;#39;, reason: rejected<br /> ...<br /> <br /> It was traced down to virtio-console. Kexec works fine if virtio-console<br /> is not in use.<br /> <br /> The issue is that virtio-console continues to write to the MMIO even after<br /> underlying virtio-pci device is reset.<br /> <br /> Additionally, Eric noticed that IOMMUs are reset before devices, if<br /> devices are not reset on shutdown they continue to poke at guest memory<br /> and get errors from the IOMMU. Some devices get wedged then.<br /> <br /> The problem can be solved by breaking all virtio devices on virtio<br /> bus shutdown, then resetting them.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.14.9 (excluding)