LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38314: virtio-pci: Fix result size returned for the admin command completion

In the Linux kernel, the following vulnerability has been resolved: virtio-pci: Fix result size returned for the admin command completion The result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes larger than the actual result data size. This occurs because the result_sg_size field of the command is filled with the result length from virtqueue_get_buf(), which includes both the data size and an additional 8 bytes of status. This oversized result size causes two issues: 1. The state transferred to the destination includes 8 bytes of extra data at the end. 2. The allocated buffer in the kernel may be smaller than the returned size, leading to failures when reading beyond the allocated size. The commit fixes this by subtracting the status size from the result of virtqueue_get_buf(). This fix has been tested through live migrations with virtio-net, virtio-net-transitional, and virtio-blk devices.

HighCVSS 7.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux virtio-pci accounting error reports an administrative command result as eight bytes larger than the real data. During affected virtual-device operations, including tested live-migration paths, software may transfer unintended extra data or read beyond an allocated buffer, risking information exposure and service failure.

Executive priority

Treat this as a high-priority kernel maintenance issue on virtualization infrastructure using virtio live migration. Accelerate vendor-supported updates where exposure is confirmed. Immediate emergency response is not supported by the supplied evidence because active exploitation is not reported.

Technical view

virtio_pci_admin_dev_parts_get() used virtqueue_get_buf()’s length without removing the eight-byte status field. The resulting oversized result_sg_size can append eight unintended bytes to migrated state and cause reads beyond the allocated result buffer. The referenced fix subtracts the status size.

Likely exposure

Exposure is most relevant to Linux systems using the affected virtio-pci administrative command path, particularly live migration involving virtio-net, virtio-net-transitional, or virtio-blk. The bundle identifies Linux 6.13 through listed 6.15.3/6.16 data, but its version boundaries are ambiguous; distribution backports require vendor verification.

Exploitation context

The supplied CVSS describes local, low-complexity exploitation requiring low privileges and no user interaction, with potentially high confidentiality and availability impact. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The affected-version metadata is internally difficult to interpret, including a standalone “0” and endpoints without explicit range semantics. Validate reachability and backports against the deployed distribution. The upstream description establishes an eight-byte length mismatch and migration testing, but does not document demonstrated exploitation, concrete attack outcomes, or temporary mitigations.

Mitigation direction

  • Install a vendor-supported kernel release containing the referenced virtio-pci fix.
  • Check distribution advisories for backported fixes and exact affected package versions.
  • Prioritize virtualization systems performing live migrations with affected virtio devices.
  • If immediate updating is impossible, consult vendor guidance for supported temporary mitigations.

Validation and detection

  • Inventory kernel versions on systems using virtio-pci devices and live migration.
  • Confirm installed kernel packages include either referenced stable fix or an equivalent vendor backport.
  • Review migration and kernel logs for virtio administrative-command or buffer-read failures.
  • Test live migration of relevant virtio-net and virtio-blk workloads after remediation.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38314 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.3CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.3High
CVSS 3.1 vector shape for CVE-2025-38314Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux704806ca400e5daa86c110f14bfdda9d28203bb7, 704806ca400e5daa86c110f14bfdda9d28203bb7unaffected
LinuxLinux6.13, 0, 6.15.3, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.