CVE-2025-38314

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38314", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.003Z", "datePublished": "2025-07-10T07:42:21.937Z", "dateUpdated": "2026-08-05T12:01:06.485Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:06.485Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-pci: Fix result size returned for the admin command completion\n\nThe result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes\nlarger than the actual result data size. This occurs because the\nresult_sg_size field of the command is filled with the result length\nfrom virtqueue_get_buf(), which includes both the data size and an\nadditional 8 bytes of status.\n\nThis oversized result size causes two issues:\n1. The state transferred to the destination includes 8 bytes of extra\n data at the end.\n2. The allocated buffer in the kernel may be smaller than the returned\n size, leading to failures when reading beyond the allocated size.\n\nThe commit fixes this by subtracting the status size from the result of\nvirtqueue_get_buf().\n\nThis fix has been tested through live migrations with virtio-net,\nvirtio-net-transitional, and virtio-blk devices."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The buggy completion handler is only driven by admin-vq commands issued from the virtio VFIO variant driver, reached through local `VFIO_DEVICE_FEATURE` migration-state ioctls and `read()` on the migration anon-inode fd. Nothing on the path processes remote or guest-supplied input, so the attacker needs local access to the host's VFIO device node.\nAC:L - The off-by-8 is unconditional \u2014 every `virtio_pci_admin_dev_parts_get()` completion returns `len` including the status SG, so the attacker simply performs a normal STOP_COPY/PRE_COPY save and reads the fd. There is no race, no timing window, and no dependence on memory layout the attacker cannot influence.\nPR:L - Neither `virtiovf_pci_set_device_state()` nor the save-fd `read()` path performs any capability check; access is gated only by permissions on the VFIO device/group node, which in the standard libvirt/QEMU model are delegated to an unprivileged VMM user. That is low privilege, not genuine host root.\nUI:N - The attacker drives the migration state transition and reads the migration file descriptor entirely on their own. No victim action, cooperation, or pre-existing migration in progress is required.\nS:U - The disclosed data and the failing operation both belong to the host kernel's own security authority, with the leak flowing to the same userspace process that already owns the VFIO device. No VM, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - Because the migration buffer pages are allocated via `alloc_pages_bulk()` without `__GFP_ZERO`, the 8 bytes past the device-written data are stale kernel page contents that `virtiovf_buf_read()` copies to userspace and that are then transmitted off-host to the migration destination. Each save/precopy cycle allocates fresh pages, so the leak can be harvested repeatedly to sample arbitrary previously-freed memory \u2014 kernel pointers, page-cache contents, or other tenants' data.\nI:L - The inflated size propagates into `virtiovf_add_buf_header()`, so the record written into the migration stream is 8 bytes too long and the destination feeds a corrupted device-parts blob to `virtio_pci_admin_dev_parts_set()`, modifying the migrated guest's device state. There is no out-of-bounds or attacker-controlled write in kernel memory, so the modification is bounded.\nA:H - Whenever the device-parts size is page-aligned, `res_size` exceeds `buf->allocated_length` and `virtiovf_get_migration_page()` returns NULL, making every `read()` on the migration fd fail with `-EINVAL` and aborting live migration for that device outright. Combined with the malformed state blob, the migrated guest's virtio device cannot be restored on the destination, denying availability of the workload being migrated."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_pci_modern.c"], "versions": [{"version": "704806ca400e5daa86c110f14bfdda9d28203bb7", "lessThan": "920b6720bb63893b81516c0c45884a8350f9e4bf", "status": "affected", "versionType": "git"}, {"version": "704806ca400e5daa86c110f14bfdda9d28203bb7", "lessThan": "9ef41ebf787fcbde99ac404ae473f8467641f983", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_pci_modern.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf"}, {"url": "https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983"}], "title": "virtio-pci: Fix result size returned for the admin command completion", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_pci_modern.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "920b6720bb63893b81516c0c45884a8350f9e4bf", "status": "affected", "version": "704806ca400e5daa86c110f14bfdda9d28203bb7", "versionType": "git"}, {"lessThan": "9ef41ebf787fcbde99ac404ae473f8467641f983", "status": "affected", "version": "704806ca400e5daa86c110f14bfdda9d28203bb7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_pci_modern.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-pci: Fix result size returned for the admin command completion\n\nThe result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes\nlarger than the actual result data size. This occurs because the\nresult_sg_size field of the command is filled with the result length\nfrom virtqueue_get_buf(), which includes both the data size and an\nadditional 8 bytes of status.\n\nThis oversized result size causes two issues:\n1. The state transferred to the destination includes 8 bytes of extra\n data at the end.\n2. The allocated buffer in the kernel may be smaller than the returned\n size, leading to failures when reading beyond the allocated size.\n\nThe commit fixes this by subtracting the status size from the result of\nvirtqueue_get_buf().\n\nThis fix has been tested through live migrations with virtio-net,\nvirtio-net-transitional, and virtio-blk devices."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-pci: Se corrige el tama\u00f1o del resultado devuelto para la finalizaci\u00f3n del comando admin El tama\u00f1o del resultado devuelto por virtio_pci_admin_dev_parts_get() es 8 bytes m\u00e1s grande que el tama\u00f1o real de los datos del resultado. Esto ocurre porque el campo result_sg_size del comando se llena con la longitud del resultado de virtqueue_get_buf(), que incluye tanto el tama\u00f1o de los datos como 8 bytes adicionales de estado. Este tama\u00f1o de resultado sobredimensionado causa dos problemas: 1. El estado transferido al destino incluye 8 bytes de datos adicionales al final. 2. El b\u00fafer asignado en el kernel puede ser m\u00e1s peque\u00f1o que el tama\u00f1o devuelto, lo que provoca fallas al leer m\u00e1s all\u00e1 del tama\u00f1o asignado. La confirmaci\u00f3n corrige esto restando el tama\u00f1o del estado del resultado de virtqueue_get_buf(). Esta correcci\u00f3n se ha probado a trav\u00e9s de migraciones en vivo con dispositivos virtio-net, virtio-net-transitional y virtio-blk. "}], "id": "CVE-2025-38314", "lastModified": "2026-07-30T06:23:06.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-10T08:15:30.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: virtio-pci: Fix result size returned for the admin command completion", "id": "2379185", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379185"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38314", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38314\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38314\nhttps://lore.kernel.org/linux-cve-announce/2025071015-CVE-2025-38314-5977@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:06:40.486799+00:00", "updated": "2025-07-13T11:06:40.486855+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}