Security readout for executives and security teams
Plain-English summary
A race condition in Linux KVM can leave an SEV or SEV-ES virtual machine with an incorrectly initialized virtual CPU during intra-host migration. The demonstrated result is a Linux host crash. The source also warns of possible unsafe hardware access, although broader confidentiality or integrity impacts are not demonstrated.
Executive priority
Treat this as high priority on hosts that use the affected confidential-virtualization features because successful triggering can crash the host and disrupt all resident workloads. Prioritize environments where automation can overlap migration and VM provisioning. Systems not using KVM/SVM with SEV or SEV-ES have substantially lower apparent exposure.
Technical view
During concurrent vCPU creation and SEV or SEV-ES state migration, KVM temporarily releases its VM lock. The destination's SEV-ES state can become active after or during SVM vCPU initialization, producing a vCPU without the required VMSA page. Freeing that vCPU can trigger a kernel page fault. The fix rejects migration while either VM has vCPU creation in flight.
Likely exposure
Exposure is limited to Linux virtualization hosts using KVM's SVM backend with SEV or SEV-ES and the affected migration path. Concurrent intra-host migration and vCPU creation must occur. The bundle identifies multiple Linux 5.x and 6.x entries, but exact distribution exposure depends on kernel backports and vendor packaging.
Exploitation context
The supplied evidence does not establish active exploitation, and the CVE is not listed as KEV. It documents a reproducible host crash and possible unsafe VMSA access. The CVSS vector describes local, low-privilege access with no user interaction.
Researcher notes
The critical race occurs between created_vcpus and online_vcpus while bulk vCPU creation runs outside kvm->lock. A false-to-true es_active transition can leave an SEV-ES VM with a non-SEV-ES vCPU and NULL VMSA. The deliberate crash behavior is fail-safe handling intended to avoid possible hardware access to a bogus VMSA page.
Mitigation direction
- Update to a distribution kernel containing the applicable upstream stable fix, following vendor guidance.
- Reboot or otherwise activate the updated kernel, then confirm the running build.
- Until patched, prevent SEV or SEV-ES migration from overlapping vCPU creation.
- Prioritize affected virtualization hosts and schedule workloads safely before kernel maintenance.
Validation and detection
- Inventory Linux hosts using KVM's SVM backend with SEV or SEV-ES enabled.
- Map each running kernel build to vendor advisories or the listed stable fix commits.
- Review orchestration paths for intra-host migration concurrent with vCPU creation.
- In a controlled environment, confirm patched kernels reject migration during in-flight vCPU creation.
- Monitor hosts for related KVM crashes or VMSA page-fault signatures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38455 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e0d9a7cf37ca09c513420dc88e0d0e805a4f0820CVE reference, Linux
- https://git.kernel.org/stable/c/8c8e8d4d7544bb783e15078eda8ba2580e192246CVE reference, Linux
- https://git.kernel.org/stable/c/fd044c99d831e9f837518816c7c366b04014d405CVE reference, Linux
- https://git.kernel.org/stable/c/b5725213149597cd9c2b075b87bc4e0f87e906c1CVE reference, Linux
- https://git.kernel.org/stable/c/ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.