CVE-2025-38508

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation

When using Secure TSC, the GUEST_TSC_FREQ MSR reports a frequency based on

the nominal P0 frequency, which deviates slightly (typically ~0.2%) from

the actual mean TSC frequency due to clocking parameters.

Over extended VM uptime, this discrepancy accumulates, causing clock skew

between the hypervisor and a SEV-SNP VM, leading to early timer interrupts as

perceived by the guest.

The guest kernel relies on the reported nominal frequency for TSC-based

timekeeping, while the actual frequency set during SNP_LAUNCH_START may

differ. This mismatch results in inaccurate time calculations, causing the

guest to perceive hrtimers as firing earlier than expected.

Utilize the TSC_FACTOR from the SEV firmware's secrets page (see "Secrets

Page Format" in the SNP Firmware ABI Specification) to calculate the mean

TSC frequency, ensuring accurate timekeeping and mitigati

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References