Security readout for executives and security teams
Plain-English summary
A Linux live-migration flaw affects certain virtual machines using HiSilicon accelerator virtual functions. If a guest lacks the corresponding VF driver, migration can leave a null data address that the destination accesses during recovery. This can cause access errors and potentially disrupt migration workloads.
Executive priority
Prioritize affected virtualization clusters because the CVSS score is high and migration failures can threaten workload continuity. Urgency is configuration-dependent rather than universal: first identify HiSilicon VF passthrough and live-migration use, then patch or temporarily restrict the risky migration scenario. No active exploitation evidence is provided.
Technical view
The hisi_acc_vfio_pci migration path may produce a NULL migrated-data address when the guest VF driver is absent. Destination-side recovery then accesses that address. The kernel resolution skips device-data migration when no VF driver is present and skips queue recovery when received queue-address data is empty. CVSS 3.1 is 8.8, requiring local, low-privileged access.
Likely exposure
Exposure appears limited to Linux virtualization hosts using hisi_acc_vfio_pci-backed HiSilicon accelerator VFs with live migration, specifically when the guest VF driver is not loaded. Systems without this device configuration or migration workflow are unlikely to encounter the described condition. The supplied version data is inconsistent, so confirm applicability against vendor guidance and fixes.
Exploitation context
The supplied record does not identify active exploitation, and the CVE is not marked as included in CISA KEV. The described trigger requires local access, low privileges, a relevant VF configuration, and a live-migration operation. Public sources supplied here establish the defect and kernel fixes, but not weaponized exploitation.
Researcher notes
The root condition is a missing guest VF driver producing absent migration data, followed by unsafe destination recovery. The fix adds two defensive decisions: omit device-data migration without the driver and omit queue recovery for empty queue-address data. The bundle provides four stable commits but does not clearly map every affected or fixed release.
Mitigation direction
- Identify hosts using hisi_acc_vfio_pci devices and VF-backed virtual-machine live migration.
- Apply a vendor-supported kernel containing the applicable stable fix referenced by the CVE record.
- Until patched, avoid live-migrating affected VMs whose guest VF driver is not loaded.
- Consult Linux distribution guidance before selecting a fixed package because supplied version ranges are ambiguous.
Validation and detection
- Record kernel and distribution package versions on virtualization hosts using relevant HiSilicon accelerator VFs.
- Confirm whether affected guests load the required VF driver before migration.
- Verify the installed kernel includes the applicable stable fix or distribution backport.
- Review migration and destination-host logs for access errors involving device or queue recovery.
- Test live migration safely in staging after remediation, including guests without the VF driver.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38283 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b5ef128926cd34dffa2a66607b9c82b902581ef8CVE reference, Linux
- https://git.kernel.org/stable/c/59a834592dd200969fdf3c61be1cb0615c647e45CVE reference, Linux
- https://git.kernel.org/stable/c/53e8e8e909f7c3a77857d09d2b733a42547f57eeCVE reference, Linux
- https://git.kernel.org/stable/c/2777a40998deb36f96b6afc48bd397cf58a4edf0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.