LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38625: vfio/pds: Fix missing detach_ioas op

In the Linux kernel, the following vulnerability has been resolved: vfio/pds: Fix missing detach_ioas op When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, the following WARN_ON() trace is seen and probe fails: WARNING: CPU: 0 PID: 5040 at drivers/vfio/vfio_main.c:317 __vfio_register_dev+0x130/0x140 [vfio] <...> pds_vfio_pci 0000:08:00.1: probe with driver pds_vfio_pci failed with error -22 This is because the driver's vfio_device_ops.detach_ioas isn't set. Fix this by using the generic vfio_iommufd_physical_detach_ioas function.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-38625 is a Linux kernel bug affecting specific VFIO use of the pds_vfio_pci driver with IOMMUFD enabled. The reported impact is device probe failure, which can disrupt systems relying on that device passthrough path. No active exploitation is reported in the provided sources.

Executive priority

Treat as targeted operational risk, not a broad emergency. Patch in normal cycles unless affected hosts support critical virtualization, passthrough, or accelerator workloads; those systems should be prioritized to avoid service disruption.

Technical view

The pds_vfio_pci driver omitted vfio_device_ops.detach_ioas when CONFIG_IOMMUFD is enabled. When binding a device to this driver, the kernel can hit a WARN_ON in vfio_main.c and fail probe with error -22. The fix uses the generic vfio_iommufd_physical_detach_ioas function.

Likely exposure

Exposure appears limited to Linux systems using the pds_vfio_pci VFIO PCI driver with CONFIG_IOMMUFD enabled. The CVE record lists affected Linux kernel versions including 6.6, 6.6.102, 6.12.42, 6.15.10, 6.16.1, and 6.17; exact downstream distro status must be verified.

Exploitation context

The sources describe a functional kernel driver failure, not a public exploit path. CISA KEV is false in the provided data, and no cited source states active exploitation. Practical risk is highest where VFIO device passthrough availability is business-critical.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploitability analysis, or downstream distro matrix is provided. The vulnerability appears configuration-specific and availability-oriented based on the described probe failure.

Mitigation direction

  • Apply a Linux kernel update containing the referenced stable fixes.
  • Check your Linux distribution advisory for the packaged fixed kernel version.
  • Prioritize systems using pds_vfio_pci with IOMMUFD enabled.
  • If unpatched, avoid relying on this VFIO path where operationally feasible.

Validation and detection

  • Inventory Linux hosts using VFIO and the pds_vfio_pci driver.
  • Confirm whether CONFIG_IOMMUFD is enabled on relevant kernels.
  • Review kernel logs for WARN_ON traces and pds_vfio_pci probe failure.
  • Verify the installed kernel includes one of the referenced stable commits.
  • Confirm affected device passthrough works after patching.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38625 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux38fe3975b4c2c5eeefb543e09f9620da18b0d069, 38fe3975b4c2c5eeefb543e09f9620da18b0d069, 38fe3975b4c2c5eeefb543e09f9620da18b0d069, 38fe3975b4c2c5eeefb543e09f9620da18b0d069, 38fe3975b4c2c5eeefb543e09f9620da18b0d069unaffected
LinuxLinux6.6, 0, 6.6.102, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.