CVE-2025-38314 (GCVE-0-2025-38314)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:42 – Updated: 2026-08-05 12:01
VLAI
Title
virtio-pci: Fix result size returned for the admin command completion
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio-pci: Fix result size returned for the admin command completion The result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes larger than the actual result data size. This occurs because the result_sg_size field of the command is filled with the result length from virtqueue_get_buf(), which includes both the data size and an additional 8 bytes of status. This oversized result size causes two issues: 1. The state transferred to the destination includes 8 bytes of extra data at the end. 2. The allocated buffer in the kernel may be smaller than the returned size, leading to failures when reading beyond the allocated size. The commit fixes this by subtracting the status size from the result of virtqueue_get_buf(). This fix has been tested through live migrations with virtio-net, virtio-net-transitional, and virtio-blk devices.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 704806ca400e5daa86c110f14bfdda9d28203bb7 , < 920b6720bb63893b81516c0c45884a8350f9e4bf (git)
Affected: 704806ca400e5daa86c110f14bfdda9d28203bb7 , < 9ef41ebf787fcbde99ac404ae473f8467641f983 (git)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio_pci_modern.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "920b6720bb63893b81516c0c45884a8350f9e4bf",
              "status": "affected",
              "version": "704806ca400e5daa86c110f14bfdda9d28203bb7",
              "versionType": "git"
            },
            {
              "lessThan": "9ef41ebf787fcbde99ac404ae473f8467641f983",
              "status": "affected",
              "version": "704806ca400e5daa86c110f14bfdda9d28203bb7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/virtio/virtio_pci_modern.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-pci: Fix result size returned for the admin command completion\n\nThe result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes\nlarger than the actual result data size. This occurs because the\nresult_sg_size field of the command is filled with the result length\nfrom virtqueue_get_buf(), which includes both the data size and an\nadditional 8 bytes of status.\n\nThis oversized result size causes two issues:\n1. The state transferred to the destination includes 8 bytes of extra\n   data at the end.\n2. The allocated buffer in the kernel may be smaller than the returned\n   size, leading to failures when reading beyond the allocated size.\n\nThe commit fixes this by subtracting the status size from the result of\nvirtqueue_get_buf().\n\nThis fix has been tested through live migrations with virtio-net,\nvirtio-net-transitional, and virtio-blk devices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The buggy completion handler is only driven by admin-vq commands issued from the virtio VFIO variant driver, reached through local `VFIO_DEVICE_FEATURE` migration-state ioctls and `read()` on the migration anon-inode fd. Nothing on the path processes remote or guest-supplied input, so the attacker needs local access to the host\u0027s VFIO device node.\nAC:L - The off-by-8 is unconditional \u2014 every `virtio_pci_admin_dev_parts_get()` completion returns `len` including the status SG, so the attacker simply performs a normal STOP_COPY/PRE_COPY save and reads the fd. There is no race, no timing window, and no dependence on memory layout the attacker cannot influence.\nPR:L - Neither `virtiovf_pci_set_device_state()` nor the save-fd `read()` path performs any capability check; access is gated only by permissions on the VFIO device/group node, which in the standard libvirt/QEMU model are delegated to an unprivileged VMM user. That is low privilege, not genuine host root.\nUI:N - The attacker drives the migration state transition and reads the migration file descriptor entirely on their own. No victim action, cooperation, or pre-existing migration in progress is required.\nS:U - The disclosed data and the failing operation both belong to the host kernel\u0027s own security authority, with the leak flowing to the same userspace process that already owns the VFIO device. No VM, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - Because the migration buffer pages are allocated via `alloc_pages_bulk()` without `__GFP_ZERO`, the 8 bytes past the device-written data are stale kernel page contents that `virtiovf_buf_read()` copies to userspace and that are then transmitted off-host to the migration destination. Each save/precopy cycle allocates fresh pages, so the leak can be harvested repeatedly to sample arbitrary previously-freed memory \u2014 kernel pointers, page-cache contents, or other tenants\u0027 data.\nI:L - The inflated size propagates into `virtiovf_add_buf_header()`, so the record written into the migration stream is 8 bytes too long and the destination feeds a corrupted device-parts blob to `virtio_pci_admin_dev_parts_set()`, modifying the migrated guest\u0027s device state. There is no out-of-bounds or attacker-controlled write in kernel memory, so the modification is bounded.\nA:H - Whenever the device-parts size is page-aligned, `res_size` exceeds `buf-\u003eallocated_length` and `virtiovf_get_migration_page()` returns NULL, making every `read()` on the migration fd fail with `-EINVAL` and aborting live migration for that device outright. Combined with the malformed state blob, the migrated guest\u0027s virtio device cannot be restored on the destination, denying availability of the workload being migrated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:06.485Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983"
        }
      ],
      "title": "virtio-pci: Fix result size returned for the admin command completion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38314",
    "datePublished": "2025-07-10T07:42:21.937Z",
    "dateReserved": "2025-04-16T04:51:24.003Z",
    "dateUpdated": "2026-08-05T12:01:06.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38314",
      "date": "2026-08-05",
      "epss": "0.00126",
      "percentile": "0.02675"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38314\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:30.363\",\"lastModified\":\"2026-07-30T06:23:06.997\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvirtio-pci: Fix result size returned for the admin command completion\\n\\nThe result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes\\nlarger than the actual result data size. This occurs because the\\nresult_sg_size field of the command is filled with the result length\\nfrom virtqueue_get_buf(), which includes both the data size and an\\nadditional 8 bytes of status.\\n\\nThis oversized result size causes two issues:\\n1. The state transferred to the destination includes 8 bytes of extra\\n   data at the end.\\n2. The allocated buffer in the kernel may be smaller than the returned\\n   size, leading to failures when reading beyond the allocated size.\\n\\nThe commit fixes this by subtracting the status size from the result of\\nvirtqueue_get_buf().\\n\\nThis fix has been tested through live migrations with virtio-net,\\nvirtio-net-transitional, and virtio-blk devices.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-pci: Se corrige el tama\u00f1o del resultado devuelto para la finalizaci\u00f3n del comando admin El tama\u00f1o del resultado devuelto por virtio_pci_admin_dev_parts_get() es 8 bytes m\u00e1s grande que el tama\u00f1o real de los datos del resultado. Esto ocurre porque el campo result_sg_size del comando se llena con la longitud del resultado de virtqueue_get_buf(), que incluye tanto el tama\u00f1o de los datos como 8 bytes adicionales de estado. Este tama\u00f1o de resultado sobredimensionado causa dos problemas: 1. El estado transferido al destino incluye 8 bytes de datos adicionales al final. 2. El b\u00fafer asignado en el kernel puede ser m\u00e1s peque\u00f1o que el tama\u00f1o devuelto, lo que provoca fallas al leer m\u00e1s all\u00e1 del tama\u00f1o asignado. La confirmaci\u00f3n corrige esto restando el tama\u00f1o del estado del resultado de virtqueue_get_buf(). Esta correcci\u00f3n se ha probado a trav\u00e9s de migraciones en vivo con dispositivos virtio-net, virtio-net-transitional y virtio-blk. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/virtio/virtio_pci_modern.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"704806ca400e5daa86c110f14bfdda9d28203bb7\",\"lessThan\":\"920b6720bb63893b81516c0c45884a8350f9e4bf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"704806ca400e5daa86c110f14bfdda9d28203bb7\",\"lessThan\":\"9ef41ebf787fcbde99ac404ae473f8467641f983\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/virtio/virtio_pci_modern.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:05+00:00",
      "cve": "CVE-2025-38314",
      "id": "CVE-2025-38314",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: virtio-pci: Fix result size returned for the admin command completion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38314.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-13T04:10:44Z",
      "cve": "CVE-2025-38314",
      "id": "CVE-2025-38314",
      "initial_release_date": "2025-07-10T23:22:45Z",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38314",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38314.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.