Skip to content
Fencer Vulns
medium 5.5

CVE-2025-38351 json

KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush

published 2025-07-19 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21959

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush

In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX allow a guest to request invalidation of portions of a virtual TLB. For this, the hypercall parameter includes a list of GVAs that are supposed to be invalidated.

However, when non-canonical GVAs are passed, there is currently no filtering in place and they are eventually passed to checked invocations of INVVPID on Intel / INVLPGA on AMD. While AMD's INVLPGA silently ignores non-canonical addresses (effectively a no-op), Intel's INVVPID explicitly signals VM-Fail and ultimately triggers the WARN_ONCE in invvpid_error():

invvpid failed: ext=0x0 vpid=1 gva=0xaaaaaaaaaaaaa000 WARNING: CPU: 6 PID: 326 at arch/x86/kvm/vmx/vmx.c:482 invvpid_error+0x91/0xa0 [kvm_intel] Modules linked in: kvm_intel kvm 9pnet_virtio irqbypass fuse CPU: 6 UID: 0 PID: 326 Comm: kvm-vm Not tainted 6.15.0 #14 PREEMPT(voluntary) RIP: 0010:invvpid_error+0x91/0xa0 [kvm_intel] Call Trace: vmx_flush_tlb_gva+0x320/0x490 [kvm_intel] kvm_hv_vcpu_flush_tlb+0x24f/0x4f0 [kvm] kvm_arch_vcpu_ioctl_run+0x3013/0x5810 [kvm]

Hyper-V documents that invalid GVAs (those that are beyond a partition's GVA space) are to be ignored. While not completely clear whether this ruling also applies to non-canonical GVAs, it is likely fine to make that assumption, and manual testing on Azure confirms "real" Hyper-V interprets the specification in the same way.

Skip non-canonical GVAs when processing the list of address to avoid tripping the INVVPID failure. Alternatively, KVM could filter out "bad" GVAs before inserting into the FIFO, but practically speaking the only downside of pushing validation to the final processing is that doing so is suboptimal for the guest, and no well-behaved guest will request TLB flushes for non-canonical addresses.

Patch / fix

  • Linux Linux 6.6.103, 6.12.41, 6.15.7, 6.16
  • linux Debian 13 6.12.41-1
  • linux Debian 14 6.16.3-1

debian advisories DEBIAN-CVE-2025-38351

  • linux Ubuntu 24.04 LTS 6.8.0-100.100
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1046.49
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1047.50
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1043.48
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1044.44
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1046.52
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1030.33
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1047.51

ubuntu advisories UBUNTU-CVE-2025-38351

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-611.8.1.el9_7
  • rv RHEL 9 5.14.0-611.8.1.el9_7
  • perf RHEL 9 5.14.0-611.8.1.el9_7
  • rtla RHEL 9 5.14.0-611.8.1.el9_7
  • libperf RHEL 9 5.14.0-611.8.1.el9_7
  • kernel-rt RHEL 9 5.14.0-611.8.1.el9_7
  • kernel-64k RHEL 9 5.14.0-611.8.1.el9_7
  • kernel-core RHEL 9 5.14.0-611.8.1.el9_7

red hat advisories RHSA-2025:21469RHSA-2025:18318RHSA-2025:17377

  • kernel-rt Linux Micro 6.2 6.12.0-160000.6.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.6.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1.160000.2.4
  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
  • kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
  • kernel-kvmsmall SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1

suse advisories SUSE-SU-2025:21074-1SUSE-SU-2025:21139-1SUSE-SU-2026:20560-1SUSE-SU-2025:21179-1SUSE-SU-2025:20870-1SUSE-SU-2025:20898-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1

opensuse advisories openSUSE-SU-2025:20081-1

  • kernel-abi-stablelists AlmaLinux 10 6.12.0-55.40.1.el10_0
  • kernel AlmaLinux 9 5.14.0-570.51.1.el9_6
  • rv AlmaLinux 9 5.14.0-570.51.1.el9_6
  • perf AlmaLinux 9 5.14.0-570.51.1.el9_6
  • rtla AlmaLinux 9 5.14.0-570.51.1.el9_6
  • libperf AlmaLinux 9 5.14.0-570.51.1.el9_6
  • kernel-rt AlmaLinux 9 5.14.0-570.51.1.el9_6
  • kernel-64k AlmaLinux 9 5.14.0-570.51.1.el9_6

almalinux advisories ALSA-2025:18318ALSA-2025:17377

  • kernel Rocky Linux 10 6.12.0-55.40.1.el10_0

rocky linux advisories RLSA-2025:18318

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-38351 updated cvss 7.3

kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush

  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-611.8.1.el9_7, rv 5.14.0-570.51.1.el9_6, perf 5.14.0-611.8.1.el9_7, rtla 5.14.0-611.8.1.el9_7, perf 5.14.0-570.51.1.el9_6, rtla 5.14.0-570.51.1.el9_6, +20 more
    fixed: vendor fix RHSA-2025:17377
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-55.40.1.el10_0, perf 6.12.0-55.40.1.el10_0, rtla 6.12.0-55.40.1.el10_0, python3-perf 6.12.0-55.40.1.el10_0, kernel-devel-matched 6.12.0-55.40.1.el10_0, kernel-64k-devel-matched 6.12.0-55.40.1.el10_0, +7 more
    fixed: vendor fix RHSA-2025:18318
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-611.8.1.el9_7, kernel 5.14.0-570.51.1.el9_6, kernel-64k 5.14.0-611.8.1.el9_7, kernel-64k 5.14.0-570.51.1.el9_6, kernel-core 5.14.0-611.8.1.el9_7, kernel-core 5.14.0-570.51.1.el9_6, +60 more
    fixed: vendor fix RHSA-2025:17377
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-55.40.1.el10_0, kernel-64k 6.12.0-55.40.1.el10_0, kernel-core 6.12.0-55.40.1.el10_0, kernel-tools 6.12.0-55.40.1.el10_0, kernel-modules 6.12.0-55.40.1.el10_0, kernel-64k-core 6.12.0-55.40.1.el10_0, +27 more
    fixed: vendor fix RHSA-2025:18318
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-611.8.1.el9_7, libperf 5.14.0-570.51.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-611.8.1.el9_7, kernel-debuginfo-common-s390x 5.14.0-570.51.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-611.8.1.el9_7, kernel-debuginfo-common-aarch64 5.14.0-611.8.1.el9_7, +4 more
    fixed: vendor fix RHSA-2025:17377
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-55.40.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.40.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.40.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.40.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.40.1.el10_0
    fixed: vendor fix RHSA-2025:18318
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-611.8.1.el9_7, kernel-rt 5.14.0-570.51.1.el9_6, kernel-rt-64k 5.14.0-611.8.1.el9_7, kernel-rt-64k 5.14.0-570.51.1.el9_6, kernel-rt-core 5.14.0-611.8.1.el9_7, kernel-rt-core 5.14.0-570.51.1.el9_6, +34 more
    fixed: vendor fix RHSA-2025:17377
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-55.40.1.el10_0, kernel-rt-64k 6.12.0-55.40.1.el10_0, kernel-rt-core 6.12.0-55.40.1.el10_0, kernel-rt-modules 6.12.0-55.40.1.el10_0, kernel-rt-64k-core 6.12.0-55.40.1.el10_0, kernel-rt-debug-core 6.12.0-55.40.1.el10_0, +14 more
    fixed: vendor fix RHSA-2025:18318
show 3 more
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-611.8.1.el9_7, kernel-rt 5.14.0-570.51.1.el9_6, kernel-rt-core 5.14.0-611.8.1.el9_7, kernel-rt-kvm 5.14.0-570.51.1.el9_6, kernel-rt-core 5.14.0-570.51.1.el9_6, kernel-rt-modules 5.14.0-611.8.1.el9_7, +16 more
    fixed: vendor fix RHSA-2025:17377
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-55.40.1.el10_0, kernel-rt-kvm 6.12.0-55.40.1.el10_0, kernel-rt-core 6.12.0-55.40.1.el10_0, kernel-rt-modules 6.12.0-55.40.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.40.1.el10_0, kernel-rt-debug-core 6.12.0-55.40.1.el10_0, +6 more
    fixed: vendor fix RHSA-2025:18318
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.