KVM: Allow CPU to reschedule while setting per-page memory attributes

published 2025-08-16 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-25092

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

When running an SEV-SNP guest with a sufficiently large amount of memory (1TB+), the host can experience CPU soft lockups when running an operation in kvm_vm_set_mem_attributes() to set memory attributes on the whole range of guest memory.

watchdog: BUG: soft lockup - CPU#8 stuck for 26s! [qemu-kvm:6372] CPU: 8 UID: 0 PID: 6372 Comm: qemu-kvm Kdump: loaded Not tainted 6.15.0-rc7.20250520.el9uek.rc1.x86_64 #1 PREEMPT(voluntary) Hardware name: Oracle Corporation ORACLE SERVER E4-2c/Asm,MB Tray,2U,E4-2c, BIOS 78016600 11/13/2024 RIP: 0010:xas_create+0x78/0x1f0 Code: 00 00 00 41 80 fc 01 0f 84 82 00 00 00 ba 06 00 00 00 bd 06 00 00 00 49 8b 45 08 4d 8d 65 08 41 39 d6 73 20 83 ed 06 48 85 c0 <74> 67 48 89 c2 83 e2 03 48 83 fa 02 75 0c 48 3d 00 10 00 00 0f 87 RSP: 0018:ffffad890a34b940 EFLAGS: 00000286 RAX: ffff96f30b261daa RBX: ffffad890a34b9c8 RCX: 0000000000000000 RDX: 000000000000001e RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffad890a356868 R13: ffffad890a356860 R14: 0000000000000000 R15: ffffad890a356868 FS: 00007f5578a2a400(0000) GS:ffff97ed317e1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f015c70fb18 CR3: 00000001109fd006 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <TASK> xas_store+0x58/0x630 __xa_store+0xa5/0x130 xa_store+0x2c/0x50 kvm_vm_set_mem_attributes+0x343/0x710 [kvm] kvm_vm_ioctl+0x796/0xab0 [kvm] __x64_sys_ioctl+0xa3/0xd0 do_syscall_64+0x8c/0x7a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f5578d031bb Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2d 4c 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe0a742b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000004020aed2 RCX: 00007f5578d031bb RDX: 00007ffe0a742c80 RSI: 000000004020aed2 RDI: 000000000000000b RBP: 0000010000000000 R08: 0000010000000000 R09: 0000017680000000 R10: 0000000000000080 R11: 0000000000000246 R12: 00005575e5f95120 R13: 00007ffe0a742c80 R14: 0000000000000008 R15: 00005575e5f961e0

While looping through the range of memory setting the attributes, call cond_resched() to give the scheduler a chance to run a higher priority task on the runqueue if necessary and avoid staying in kernel mode long enough to trigger the lockup.

Patch / fix

fixed in 1 distros 4 links 3

Linux Linux 6.12.39, 6.15.7, 6.16

debian ubuntu suse opensuse

linux Debian 13 6.12.41-1
linux Debian 14 6.16.3-1

debian advisories DEBIAN-CVE-2025-38506

linux Ubuntu 24.04 LTS 6.8.0-100.100
linux-aws Ubuntu 24.04 LTS 6.8.0-1046.49
linux-gcp Ubuntu 24.04 LTS 6.8.0-1047.50
linux-gke Ubuntu 24.04 LTS 6.8.0-1043.48
linux-ibm Ubuntu 24.04 LTS 6.8.0-1044.44
linux-azure Ubuntu 24.04 LTS 6.8.0-1046.52
linux-gkeop Ubuntu 24.04 LTS 6.8.0-1030.33
linux-raspi Ubuntu 24.04 LTS 6.8.0-1047.51

ubuntu advisories UBUNTU-CVE-2025-38506

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt Linux Micro 6.2 6.12.0-160000.6.1
kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.6.1
kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1.160000.2.4
kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
kernel-kvmsmall SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1

suse advisories SUSE-SU-2025:21074-1 SUSE-SU-2025:21139-1 SUSE-SU-2026:20560-1 SUSE-SU-2025:21179-1 SUSE-SU-2025:03634-1 SUSE-SU-2025:03633-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1

opensuse advisories openSUSE-SU-2025:20081-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-38506 updated 2026-11-05 cvss 5.5

kernel: KVM: Allow CPU to reschedule while setting per-page memory attributes

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-667 Improper Locking

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2025-38506
NVD CVE-2025-38506

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary