Security readout for executives and security teams
Plain-English summary
A Linux flaw affects some SEV-SNP confidential-computing guests when memory changes from shared to private. Without the required cache-line handling, memory validation may not be trustworthy. The supplied CVSS assessment rates potential confidentiality, integrity, and availability impacts as high, although the sources do not describe a demonstrated attack.
Executive priority
Treat this as an urgent, targeted infrastructure update rather than an internet-wide emergency. Prioritize confidential-computing environments using SEV-SNP, validate hardware exemption status, and deploy supported fixed kernels promptly. Lower priority applies to systems demonstrably outside SEV-SNP use.
Technical view
After an SNP page-state change to private, vulnerable guests require cache-line eviction before memory validation. The kernel fix touches the first and last byte of every 4 KiB page being validated. This mitigation applies when CPUID Fn8000001F_EBX[31], COHERENCY_SFW_NO, is not set; shared transitions and validation rescission do not require it.
Likely exposure
Exposure is limited to affected Linux kernels operating as SEV-SNP guests where COHERENCY_SFW_NO is absent. Systems not using SEV-SNP, or hardware reporting that bit, are not described as requiring the software mitigation. The supplied affected-version data is not sufficiently clear for reliable range-based scanning, so confirm fixes by distribution package or kernel commit.
Exploitation context
The CVSS vector indicates a local, low-complexity, unauthenticated attack requiring no user interaction and allowing scope change. However, the supplied sources do not report active exploitation or a public exploit, and the CVE is not identified as being in CISA KEV. Absence from KEV does not establish that exploitation is impossible.
Researcher notes
The record provides no CWE and does not explain the precise attacker-controlled mechanism or prerequisites beyond the local CVSS vector and vulnerable SNP coherency condition. Stable-kernel commits implement a narrowly scoped validation-time mitigation. Version entries in the supplied affected data appear ambiguous, so commit or vendor-package verification is more dependable than version-string inference.
Mitigation direction
- Apply a supported distribution kernel containing the applicable upstream stable fix.
- Prioritize SEV-SNP guest kernels where COHERENCY_SFW_NO is not set.
- Consult Linux and distribution advisories for fixed package versions.
- Avoid treating the CPUID exemption as applicable unless it is positively verified.
Validation and detection
- Inventory Linux systems running as SEV-SNP guests.
- Determine whether CPUID Fn8000001F_EBX[31] is set for each relevant guest environment.
- Verify installed kernels include the appropriate stable fix or distribution backport.
- Confirm updated guests boot successfully and private-memory validation workflows remain operational.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38560 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H2.56LinuxVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1fec416c03d0a64cc21aa04ce4aa14254b017e6aCVE reference, Linux
- https://git.kernel.org/stable/c/1fb873971e23c35c53823c62809a474a92bc3022CVE reference, Linux
- https://git.kernel.org/stable/c/aed15fc08f15dbb15822b2a0b653f67e76aa0fdfCVE reference, Linux
- https://git.kernel.org/stable/c/a762a4c8d9e768b538b3cc60615361a8cf377de8CVE reference, Linux
- https://git.kernel.org/stable/c/f92af52e6dbd8d066d77beba451e0230482dc45bCVE reference, Linux
- https://git.kernel.org/stable/c/7b306dfa326f70114312b320d083b21fa9481e1eCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.