Riskcovery

CVE-2025-38064

virtio: break and reset virtio devices on device_shutdown()

State
Published
Severity
7.8 High
Published
Jun 18, 2025
Updated
Oct 30, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio: break and reset virtio devices on device_shutdown()

Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang.

Invalid read at addr 0x102877002, size 2, region '(null)', reason: rejected Invalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected ...

It was traced down to virtio-console. Kexec works fine if virtio-console is not in use.

The issue is that virtio-console continues to write to the MMIO even after underlying virtio-pci device is reset.

Additionally, Eric noticed that IOMMUs are reset before devices, if devices are not reset on shutdown they continue to poke at guest memory and get errors from the IOMMU. Some devices get wedged then.

The problem can be solved by breaking all virtio devices on virtio bus shutdown, then resetting them.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ec3d41c4db4c21164332826ea8d812f94f2f6886 to before 0c03e32494dd0bbcc301523e5ae567c2f567a7d9Affected
  • ec3d41c4db4c21164332826ea8d812f94f2f6886 to before acdfe206be6c70ec55dc8bfdb1a22036d10fae26Affected
  • ec3d41c4db4c21164332826ea8d812f94f2f6886 to before 1eaa83fd94ed5e40d43139025f5acb7bcfed3b5fAffected
  • ec3d41c4db4c21164332826ea8d812f94f2f6886 to before aee42f3d57bfa37b2716df4584edeecf63b9df4cAffected
  • ec3d41c4db4c21164332826ea8d812f94f2f6886 to before 8bd2fa086a04886798b505f28db4002525895203Affected
LinuxLinux
  • 2.6.24Affected
  • before 2.6.24Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.14.9 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.