CVE-2025-38455

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight

Reject migration of SEV{-ES} state if either the source or destination VM

is actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the

section between incrementing created_vcpus and online_vcpus. The bulk of

vCPU creation runs _outside_ of kvm->lock to allow creating multiple vCPUs

in parallel, and so sev_info.es_active can get toggled from false=>true in

the destination VM after (or during) svm_vcpu_create(), resulting in an

SEV{-ES} VM effectively having a non-SEV{-ES} vCPU.

The issue manifests most visibly as a crash when trying to free a vCPU's

NULL VMSA page in an SEV-ES VM, but any number of things can go wrong.

BUG: unable to handle page fault for address: ffffebde00000000

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: Oops: 0000 [#1] SMP KASAN NOPTI

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References