CVE-2025-38351

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush

In KVM guests with Hyper-V hypercalls enabled, the hypercalls

HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX

allow a guest to request invalidation of portions of a virtual TLB.

For this, the hypercall parameter includes a list of GVAs that are supposed

to be invalidated.

However, when non-canonical GVAs are passed, there is currently no

filtering in place and they are eventually passed to checked invocations of

INVVPID on Intel / INVLPGA on AMD. While AMD's INVLPGA silently ignores

non-canonical addresses (effectively a no-op), Intel's INVVPID explicitly

signals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error():

invvpid failed: ext=0x0 vpid=1 gva=0xaaaaaaaaaaaaa000

WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482

invvpid_error+0x91/0xa0 [kvm_intel]

Modules linked in: kvm_intel kvm 9pnet_virti

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References