GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38366 (GCVE-0-2025-38366)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:47 – Updated: 2026-08-05 12:01
VLAI
Title
LoongArch: KVM: Check validity of "num_cpu" from user space
Summary
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check validity of "num_cpu" from user space The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about irqchip EIOINTC, here add validation about cpu number to avoid array pointer overflow.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00 , < a3293b4078ee93174f70f36d3ab7618554ce6ab6 (git)
Affected: 1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00 , < cc8d5b209e09d3b52bca1ffe00045876842d96ae (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.15.5 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/intc/eiointc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3293b4078ee93174f70f36d3ab7618554ce6ab6",
              "status": "affected",
              "version": "1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00",
              "versionType": "git"
            },
            {
              "lessThan": "cc8d5b209e09d3b52bca1ffe00045876842d96ae",
              "status": "affected",
              "version": "1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/kvm/intc/eiointc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Check validity of \"num_cpu\" from user space\n\nThe maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about\nirqchip EIOINTC, here add validation about cpu number to avoid array\npointer overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through ioctls on a local KVM device file descriptor (`/dev/kvm` \u2192 `KVM_CREATE_VM` \u2192 `KVM_CREATE_DEVICE` \u2192 `KVM_SET/GET_DEVICE_ATTR`); there is no network or remote path into `kvm_eiointc_regs_access()`.\nAC:L - A single ioctl with `attr-\u003eattr = (cpuid \u003c\u003c 16) | 0x400` deterministically produces the out-of-bounds access \u2014 no race, no timing dependency, and the attacker fully chooses the \u00b11 MiB displacement and the written value. KVM is enabled by default in `loongson64_defconfig`.\nPR:L - The attacker needs only the ability to open `/dev/kvm` and create a VM \u2014 routinely granted to unprivileged local users and cloud/desktop VM users \u2014 and neither `kvm_ioctl_create_device()` nor `kvm_device_ioctl_attr()` performs any capability check.\nUI:N - The attacker drives the entire sequence from its own process with plain ioctls; no host operator, guest owner, or other user has to take any action.\nS:U - Both the vulnerable and the impacted component are the host kernel, reached by host userspace through its normal syscall interface \u2014 a classic local privilege escalation within one security authority, not a guest-to-host hypervisor escape (the guest MMIO paths index `coreisr` by the bounded `vcpu-\u003evcpu_id`).\nC:H - `KVM_GET_DEVICE_ATTR` performs `copy_to_user(data, p, 4)` from an attacker-chosen 4-byte-aligned address up to 1 MiB either side of the ~74 KB `loongarch_eiointc` allocation, giving a repeatable, sweepable read of adjacent kernel memory \u2014 effectively arbitrary kernel-heap disclosure including pointers and secrets.\nI:H - `KVM_SET_DEVICE_ATTR` performs `copy_from_user(p, data, 4)` to the same attacker-chosen out-of-bounds address, yielding a controlled 4-byte write anywhere in a 2 MiB window around a page-allocator-backed object \u2014 a memory-corruption primitive directly leverageable for control-flow hijack and full privilege escalation.\nA:H - The same out-of-bounds write can clobber arbitrary neighboring kernel structures, and the unvalidated `num_cpu`/`cpuid` accesses reliably corrupt or fault kernel memory, producing an oops or panic that takes down the host and every VM on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:23.461Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3293b4078ee93174f70f36d3ab7618554ce6ab6"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc8d5b209e09d3b52bca1ffe00045876842d96ae"
        }
      ],
      "title": "LoongArch: KVM: Check validity of \"num_cpu\" from user space",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38366",
    "datePublished": "2025-07-25T12:47:36.104Z",
    "dateReserved": "2025-04-16T04:51:24.008Z",
    "dateUpdated": "2026-08-05T12:01:23.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38366",
      "date": "2026-09-16",
      "epss": "0.00148",
      "percentile": "0.04377"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38366\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:25.500\",\"lastModified\":\"2026-07-30T06:23:10.487\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nLoongArch: KVM: Check validity of \\\"num_cpu\\\" from user space\\n\\nThe maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about\\nirqchip EIOINTC, here add validation about cpu number to avoid array\\npointer overflow.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: KVM: verificar la validez de \\\"num_cpu\\\" desde el espacio del usuario. El n\u00famero m\u00e1ximo de CPU admitido es EIOINTC_ROUTE_MAX_VCPUS sobre irqchip EIOINTC, aqu\u00ed agregue validaci\u00f3n sobre el n\u00famero de CPU para evitar el desbordamiento del puntero de la matriz.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/loongarch/kvm/intc/eiointc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00\",\"lessThan\":\"a3293b4078ee93174f70f36d3ab7618554ce6ab6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1ad7efa552fd5cf4e8c49fea863c5c6a5dcf9f00\",\"lessThan\":\"cc8d5b209e09d3b52bca1ffe00045876842d96ae\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/loongarch/kvm/intc/eiointc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.5\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.5\",\"matchCriteriaId\":\"0CC768E2-3BBC-4A6E-9C2F-ECB27A703C2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a3293b4078ee93174f70f36d3ab7618554ce6ab6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cc8d5b209e09d3b52bca1ffe00045876842d96ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:06+00:00",
      "cve": "CVE-2025-38366",
      "id": "CVE-2025-38366",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: LoongArch: KVM: Check validity of \"num_cpu\" from user space",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38366.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:10:24Z",
      "cve": "CVE-2025-38366",
      "id": "CVE-2025-38366",
      "initial_release_date": "2025-07-28T23:24:07Z",
      "product_status:known_not_affected": "416",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38366",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38366.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.