{ "schema_version": "1.6.1", "id": "RPI-CVE-2025-38506", "modified": "2026-10-07T17:22:01Z", "upstream": [ "CVE-2025-38506" ], "published": "2025-08-16T10:58:18Z", "summary": "KVM: Allow CPU to reschedule while setting per-page memory attributes", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Allow CPU to reschedule while setting per-page memory attributes\n\nWhen running an SEV-SNP guest with a sufficiently large amount of memory (1TB+),\nthe host can experience CPU soft lockups when running an operation in\nkvm_vm_set_mem_attributes() to set memory attributes on the whole\nrange of guest memory.\n\nwatchdog: BUG: soft lockup - CPU#8 stuck for 26s! [qemu-kvm:6372]\nCPU: 8 UID: 0 PID: 6372 Comm: qemu-kvm Kdump: loaded Not tainted 6.15.0-rc7.20250520.el9uek.rc1.x86_64 #1 PREEMPT(voluntary)\nHardware name: Oracle Corporation ORACLE SERVER E4-2c/Asm,MB Tray,2U,E4-2c, BIOS 78016600 11/13/2024\nRIP: 0010:xas_create+0x78/0x1f0\nCode: 00 00 00 41 80 fc 01 0f 84 82 00 00 00 ba 06 00 00 00 bd 06 00 00 00 49 8b 45 08 4d 8d 65 08 41 39 d6 73 20 83 ed 06 48 85 c0 <74> 67 48 89 c2 83 e2 03 48 83 fa 02 75 0c 48 3d 00 10 00 00 0f 87\nRSP: 0018:ffffad890a34b940 EFLAGS: 00000286\nRAX: ffff96f30b261daa RBX: ffffad890a34b9c8 RCX: 0000000000000000\nRDX: 000000000000001e RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffad890a356868\nR13: ffffad890a356860 R14: 0000000000000000 R15: ffffad890a356868\nFS: 00007f5578a2a400(0000) GS:ffff97ed317e1000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f015c70fb18 CR3: 00000001109fd006 CR4: 0000000000f70ef0\nPKRU: 55555554\nCall Trace:\n \n xas_store+0x58/0x630\n __xa_store+0xa5/0x130\n xa_store+0x2c/0x50\n kvm_vm_set_mem_attributes+0x343/0x710 [kvm]\n kvm_vm_ioctl+0x796/0xab0 [kvm]\n __x64_sys_ioctl+0xa3/0xd0\n do_syscall_64+0x8c/0x7a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f5578d031bb\nCode: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2d 4c 0f 00 f7 d8 64 89 01 48\nRSP: 002b:00007ffe0a742b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 000000004020aed2 RCX: 00007f5578d031bb\nRDX: 00007ffe0a742c80 RSI: 000000004020aed2 RDI: 000000000000000b\nRBP: 0000010000000000 R08: 0000010000000000 R09: 0000017680000000\nR10: 0000000000000080 R11: 0000000000000246 R12: 00005575e5f95120\nR13: 00007ffe0a742c80 R14: 0000000000000008 R15: 00005575e5f961e0\n\nWhile looping through the range of memory setting the attributes,\ncall cond_resched() to give the scheduler a chance to run a higher\npriority task on the runqueue if necessary and avoid staying in\nkernel mode long enough to trigger the lockup.", "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.20-1+rpt1~bpo12+1", "1:6.12.25-1+rpt1", "1:6.12.34-1+rpt1~bookworm" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.20+rpt-rpi-2712", "binary_version": "1:6.12.20-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.20+rpt-rpi-v8", "binary_version": "1:6.12.20-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-2712", "binary_version": "1:6.12.25-1+rpt1" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-v8", "binary_version": "1:6.12.25-1+rpt1" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-2712", "binary_version": "1:6.12.34-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8", "binary_version": "1:6.12.34-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt", "binary_version": "1:6.12.34-1+rpt1~bookworm" } ] }, "database_specific": { "per_version": { "1:6.12.20-1+rpt1~bpo12+1": { "linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa", "upstream_version": "6.12.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" }, "1:6.12.25-1+rpt1": { "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16", "upstream_version": "6.12.25", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" }, "1:6.12.34-1+rpt1~bookworm": { "linux_commit": "8f77e03530f65209a377d25023e912b288e039cd", "upstream_version": "6.12.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.12.19-1+rpt1~bpo12+1", "1:6.12.19-1+rpt1", "1:6.12.20-1+rpt1", "1:6.12.25-1+rpt1+trixie", "1:6.12.34-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.19+rpt-rpi-2712", "binary_version": "1:6.12.19-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.19+rpt-rpi-v8", "binary_version": "1:6.12.19-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.19+rpt-rpi-2712", "binary_version": "1:6.12.19-1+rpt1" }, { "binary_name": "linux-image-6.12.19+rpt-rpi-v8", "binary_version": "1:6.12.19-1+rpt1" }, { "binary_name": "linux-image-6.12.20+rpt-rpi-2712", "binary_version": "1:6.12.20-1+rpt1" }, { "binary_name": "linux-image-6.12.20+rpt-rpi-v8", "binary_version": "1:6.12.20-1+rpt1" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-2712", "binary_version": "1:6.12.25-1+rpt1+trixie" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-v8", "binary_version": "1:6.12.25-1+rpt1+trixie" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-v8-rt", "binary_version": "1:6.12.25-1+rpt1+trixie" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-2712", "binary_version": "1:6.12.34-1+rpt1" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8", "binary_version": "1:6.12.34-1+rpt1" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt", "binary_version": "1:6.12.34-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.19-1+rpt1~bpo12+1": { "linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0", "upstream_version": "6.12.19", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" }, "1:6.12.19-1+rpt1": { "linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0", "upstream_version": "6.12.19", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" }, "1:6.12.20-1+rpt1": { "linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa", "upstream_version": "6.12.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" }, "1:6.12.25-1+rpt1+trixie": { "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16", "upstream_version": "6.12.25", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" }, "1:6.12.34-1+rpt1": { "linux_commit": "8f77e03530f65209a377d25023e912b288e039cd", "upstream_version": "6.12.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.39" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38506" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d9bd1163c8d8f716f45e54d034ee28757cc85549" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/1ef45ae7a3938f0844032ba670b4f89180a5bffc" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/47bb584237cc285e3a860b70c01f7bda9dcfb05b" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-05-12T04:54:46Z" } }