CVE-2025-38064
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
18/06/2025
Last modified:
14/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
virtio: break and reset virtio devices on device_shutdown()<br />
<br />
Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory<br />
accesses during the hang.<br />
<br />
Invalid read at addr 0x102877002, size 2, region &#39;(null)&#39;, reason: rejected<br />
Invalid write at addr 0x102877A44, size 2, region &#39;(null)&#39;, reason: rejected<br />
...<br />
<br />
It was traced down to virtio-console. Kexec works fine if virtio-console<br />
is not in use.<br />
<br />
The issue is that virtio-console continues to write to the MMIO even after<br />
underlying virtio-pci device is reset.<br />
<br />
Additionally, Eric noticed that IOMMUs are reset before devices, if<br />
devices are not reset on shutdown they continue to poke at guest memory<br />
and get errors from the IOMMU. Some devices get wedged then.<br />
<br />
The problem can be solved by breaking all virtio devices on virtio<br />
bus shutdown, then resetting them.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.14.9 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



