Security readout for executives and security teams
Plain-English summary
A flaw in Linux KVM for LoongArch can let an array index exceed its intended bounds while updating an interrupt-controller register. The supplied CVSS assessment indicates potentially severe confidentiality, integrity, and availability impact across a security boundary. Exposure appears limited to affected LoongArch virtualization environments rather than general Linux deployments.
Executive priority
Treat as a high-priority, targeted infrastructure issue. Rapidly inventory LoongArch KVM hosts, especially those exposed to untrusted local users or workloads, then follow vendor remediation guidance. Broad emergency action across unrelated architectures is not supported by the supplied evidence.
Technical view
The EIOINTC_ENABLE register-handling path modifies an index and then reuses it for array access, permitting an out-of-bounds index. The bundle assigns CVSS 3.1 score 8.8 with local, low-privilege access and changed scope. It does not establish the precise corrupted object, reachable bounds, or a demonstrated guest-to-host escape.
Likely exposure
Prioritize Linux systems using KVM on LoongArch and matching vendor-confirmed affected kernels. The supplied version data names 6.13, 6.15.5, and 6.16 but is insufficiently structured to define a reliable complete range. Non-LoongArch systems or systems not using this KVM functionality appear outside the described flaw.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source reports active exploitation or provides a public proof of concept. The CVSS vector indicates exploitation requires local, low-privilege access without user interaction. The exact attacker context and reachable trust boundary are not explained by the supplied evidence.
Researcher notes
The source bundle identifies an array-index overflow in LoongArch KVM EIOINTC_ENABLE handling and provides two stable-kernel commits. It supplies no CWE, crash analysis, exploit demonstration, or precise upstream version intervals. Validate backports by commit or vendor build metadata rather than relying only on displayed kernel version labels.
Mitigation direction
- Identify LoongArch hosts using KVM and record their exact kernel builds.
- Check distribution or kernel-vendor guidance for affected build mappings.
- Upgrade to a supported kernel incorporating the referenced stable fixes.
- Until updated, reduce untrusted access to affected virtualization hosts and workloads.
Validation and detection
- Confirm system architecture, KVM usage, kernel version, and distribution build identifier.
- Verify the installed kernel contains the applicable referenced stable commit.
- Review vendor advisories because distribution version numbers may differ from upstream versions.
- Reboot into the corrected kernel and confirm the active build afterward.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2cc84c4b0d70d42e291862ecc848890d18e1004aCVE reference, Linux
- https://git.kernel.org/stable/c/080e8d2ecdfde588897aa8a87a8884061f4dbbbbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.