CVE-2025-38560
Linux Kernel vulnerability
- Published19 Aug 2025
Description
In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] defines the COHERENCY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCY_SFW_NO bit is not set, indicating the SNP guest is vulnerable.
CVSS 3.1 breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAffected products
Remediation
- https://git.kernel.org/stable/c/1fb873971e23c35c53823c62809a474a92bc3022
- https://git.kernel.org/stable/c/1fec416c03d0a64cc21aa04ce4aa14254b017e6a
- https://git.kernel.org/stable/c/7b306dfa326f70114312b320d083b21fa9481e1e
- https://git.kernel.org/stable/c/a762a4c8d9e768b538b3cc60615361a8cf377de8
- https://git.kernel.org/stable/c/aed15fc08f15dbb15822b2a0b653f67e76aa0fdf
- https://git.kernel.org/stable/c/f92af52e6dbd8d066d77beba451e0230482dc45b
References
- https://git.kernel.org/stable/c/1fb873971e23c35c53823c62809a474a92bc3022
- https://git.kernel.org/stable/c/1fec416c03d0a64cc21aa04ce4aa14254b017e6a
- https://git.kernel.org/stable/c/7b306dfa326f70114312b320d083b21fa9481e1e
- https://git.kernel.org/stable/c/a762a4c8d9e768b538b3cc60615361a8cf377de8
- https://git.kernel.org/stable/c/aed15fc08f15dbb15822b2a0b653f67e76aa0fdf
- https://git.kernel.org/stable/c/f92af52e6dbd8d066d77beba451e0230482dc45b
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Frequently asked
Is CVE-2025-38560 being actively exploited?
CVE-2025-38560 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.17%.
How severe is CVE-2025-38560?
CVE-2025-38560 has a CVSS 3.1 base score of 9.3, rated critical. EPSS estimates a 0.17% probability of exploitation.
Which products are affected by CVE-2025-38560?
Affected products include Debian Linux, Linux Kernel.
How do I fix CVE-2025-38560?
Upgrade affected software to a fixed version, for example Linux Kernel 6.1.148 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2025-38560 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.