CVE-2025-38064 (GCVE-0-2025-38064)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:33 – Updated: 2026-08-05 11:59
VLAI
Title
virtio: break and reset virtio devices on device_shutdown()
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on device_shutdown() Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang. Invalid read at addr 0x102877002, size 2, region '(null)', reason: rejected Invalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected ... It was traced down to virtio-console. Kexec works fine if virtio-console is not in use. The issue is that virtio-console continues to write to the MMIO even after underlying virtio-pci device is reset. Additionally, Eric noticed that IOMMUs are reset before devices, if devices are not reset on shutdown they continue to poke at guest memory and get errors from the IOMMU. Some devices get wedged then. The problem can be solved by breaking all virtio devices on virtio bus shutdown, then resetting them.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ec3d41c4db4c21164332826ea8d812f94f2f6886 , < aee42f3d57bfa37b2716df4584edeecf63b9df4c (git)
Affected: ec3d41c4db4c21164332826ea8d812f94f2f6886 , < 8bd2fa086a04886798b505f28db4002525895203 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 6.14.9 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aee42f3d57bfa37b2716df4584edeecf63b9df4c",
              "status": "affected",
              "version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
              "versionType": "git"
            },
            {
              "lessThan": "8bd2fa086a04886798b505f28db4002525895203",
              "status": "affected",
              "version": "ec3d41c4db4c21164332826ea8d812f94f2f6886",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region \u0027(null)\u0027, reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region \u0027(null)\u0027, reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is `device_shutdown()`, reached only through local reboot/halt/kexec syscalls in `kernel/reboot.c`; no network or adjacent-network input reaches the virtio bus shutdown code. The impact lands on the local system (guest kernel), so the vector is Local.\nAC:L - The failure is deterministic rather than a race \u2014 every reboot/kexec on a system with an in-use virtio device (virtio-console, virtio-net, virtio-blk) leaves the device unquiesced, and the reporter noted kexec hangs reliably whenever virtio-console is in use. No memory-layout or timing conditions outside the attacker\u0027s control are required.\nPR:L - Although `reboot()`/`kexec_load()` nominally check `CAP_SYS_BOOT`, unprivileged local users on typical desktop, embedded and appliance deployments can initiate a system reboot or power-off through logind/polkit (and Ctrl-Alt-Del reaches `ctrl_alt_del()` with no credentials at all), so a basic local user can reach `device_shutdown()`. Choosing the higher-severity option, this is Low rather than High.\nUI:N - The reboot/kexec that triggers the unquiesced-device window is performed by the attacker themselves; no separate victim has to open a file, mount a filesystem, or take any other action.\nS:U - Both the flawed code and the damage \u2014 the hang, the stray MMIO/DMA traffic, and the corruption of the newly loaded kernel image \u2014 are confined to the same kernel/guest security authority. The virtio backend that performs the stray DMA already holds authority over that memory, so no privilege boundary is crossed.\nC:H - With virtqueues left armed and `intel_iommu_shutdown()` having already disabled translation and protected memory regions, the still-live device continues DMA *reads* from stale ring and buffer physical addresses \u2014 QEMU observed exactly this (\"Invalid read at addr 0x102877002\"). Those reads hand the contents of memory now owned by the kexec\u0027d kernel to the device backend, an unbounded kernel-memory disclosure.\nI:H - The same unreset devices continue DMA *writes* into stale buffer addresses (\"Invalid write at addr 0x102877A44\") after DMA isolation has been torn down, so a device such as virtio-net can deposit remote-attacker-supplied packet bytes into memory that the freshly loaded kernel has repurposed for its own image and data. That is arbitrary corruption of the incoming kernel, exploitable for control-flow hijack.\nA:H - The reported symptom is a hard hang of the VM on kexec \u2014 the machine never completes the boot and requires an out-of-band power cycle \u2014 and the commit further notes that devices \"get wedged\" once the IOMMU rejects their accesses. Complete loss of availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:11.657Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aee42f3d57bfa37b2716df4584edeecf63b9df4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bd2fa086a04886798b505f28db4002525895203"
        }
      ],
      "title": "virtio: break and reset virtio devices on device_shutdown()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38064",
    "datePublished": "2025-06-18T09:33:42.931Z",
    "dateReserved": "2025-04-16T04:51:23.980Z",
    "dateUpdated": "2026-08-05T11:59:11.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38064",
      "date": "2026-08-04",
      "epss": "0.00147",
      "percentile": "0.04461"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T02:00:11.000Z",
      "cve": "CVE-2025-38064",
      "id": "msrc_CVE-2025-38064",
      "initial_release_date": "2025-06-02T00:00:00.000Z",
      "product_status:known_affected": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "virtio: break and reset virtio devices on device_shutdown()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38064.json",
      "version": "16"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38064\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T10:15:39.340\",\"lastModified\":\"2026-07-30T06:22:47.740\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvirtio: break and reset virtio devices on device_shutdown()\\n\\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\\naccesses during the hang.\\n\\n\\tInvalid read at addr 0x102877002, size 2, region \u0027(null)\u0027, reason: rejected\\n\\tInvalid write at addr 0x102877A44, size 2, region \u0027(null)\u0027, reason: rejected\\n\\t...\\n\\nIt was traced down to virtio-console. Kexec works fine if virtio-console\\nis not in use.\\n\\nThe issue is that virtio-console continues to write to the MMIO even after\\nunderlying virtio-pci device is reset.\\n\\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\\ndevices are not reset on shutdown they continue to poke at guest memory\\nand get errors from the IOMMU. Some devices get wedged then.\\n\\nThe problem can be solved by breaking all virtio devices on virtio\\nbus shutdown, then resetting them.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio: interrumpir y reiniciar dispositivos virtio en device_shutdown() Hongyu inform\u00f3 de un bloqueo en kexec en una m\u00e1quina virtual. QEMU inform\u00f3 de accesos a memoria no v\u00e1lidos durante el bloqueo. Lectura no v\u00e1lida en la direcci\u00f3n 0x102877002, tama\u00f1o 2, regi\u00f3n \u0027(null)\u0027, motivo: rechazada Escritura no v\u00e1lida en la direcci\u00f3n 0x102877A44, tama\u00f1o 2, regi\u00f3n \u0027(null)\u0027, motivo: rechazada ... Se rastre\u00f3 hasta virtio-console. Kexec funciona bien si virtio-console no est\u00e1 en uso. El problema es que virtio-console contin\u00faa escribiendo en el MMIO incluso despu\u00e9s de reiniciar el dispositivo virtio-pci subyacente. Adem\u00e1s, Eric not\u00f3 que las IOMMU se reinician antes que los dispositivos; si los dispositivos no se reinician al apagar, contin\u00faan presionando la memoria invitada y obtienen errores de la IOMMU. Algunos dispositivos se bloquean entonces. El problema se puede resolver rompiendo todos los dispositivos virtio al apagar el bus virtio y luego reinici\u00e1ndolos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/virtio/virtio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ec3d41c4db4c21164332826ea8d812f94f2f6886\",\"lessThan\":\"aee42f3d57bfa37b2716df4584edeecf63b9df4c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec3d41c4db4c21164332826ea8d812f94f2f6886\",\"lessThan\":\"8bd2fa086a04886798b505f28db4002525895203\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/virtio/virtio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.24\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.24\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.9\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.14.9\",\"matchCriteriaId\":\"77E9095E-F219-488D-B19D-B194A129A9D6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8bd2fa086a04886798b505f28db4002525895203\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aee42f3d57bfa37b2716df4584edeecf63b9df4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:23:03+00:00",
      "cve": "CVE-2025-38064",
      "id": "CVE-2025-38064",
      "initial_release_date": "2025-06-18T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: virtio: break and reset virtio devices on device_shutdown()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38064.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.