UBUNTU-CVE-2025-38064: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on deviceshutdown() Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang. Invalid read at addr 0x102877002, size 2, region '(null)', reason: rejected Invalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected ... It was traced down to virtio-console. Kexec works fine if virtio-console is not in use. The issue is that virtio-console continues to write to the MMIO even after underlying virtio-pci device is reset. Additionally, Eric noticed that IOMMUs are reset before devices, if devices are not reset on shutdown they continue to poke at guest memory and get errors from the IOMMU. Some devices get wedged then. The problem can be solved by breaking all virtio devices on virtio bus shutdown, then resetting them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-32.32.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1012.12~24.04.1 - Compensating control
On virtio bus shutdown, break all virtio devices before resetting them so devices such as virtio-console cannot continue writing to MMIO after the underlying virtio-pci device is reset.
Event History
Frequently Asked Questions
What access would an attacker need?
The severity vector indicates local access with low privileges is required and no user interaction is needed. The vector does not indicate a network-based attack path.
Which systems are most relevant to this issue?
The reported failure occurred in a virtual machine using virtio, and it was traced to virtio-console activity during kexec. Ubuntu lists its standard, AWS, Azure, GCP, and FIPS kernel packages as affected software.
What can be done if an update cannot be applied immediately?
Avoid using virtio-console during kexec where possible; the report states that kexec worked when virtio-console was not in use. This is a workaround for the reported trigger, not a general fix.
How might an affected system behave?
Observed symptoms include a hang during kexec, invalid memory access reports from QEMU, IOMMU errors, and devices becoming wedged during shutdown or reset handling.