PT-2025-25801 · Linux · Linux Kernel

Published 2025-06-18 · Updated 2025-06-18 · CVE-2025-38026

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the x86/sev component. The issue occurs when kdump is running makedumpfile to generate vmcore and dump SNP guest memory, causing it to touch the VMSA page of the vCPU executing kdump. This results in unrecoverable #NPF/RMP faults as the VMSA page is marked busy/in-use when the vCPU is running, leading to a guest softlockup/hang. Other APs may also be halted in guest mode, and their VMSA pages are marked busy, causing #NPF when touched during guest memory dump. The issue is resolved by issuing AP DESTROY GHCB calls on other APs to ensure they are kicked out of guest mode and then clearing the VMSA bit on their VMSA pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-38026

Affected Products

Linux Kernel

References · 8

• https://ubuntu.com/security/CVE-2025-38026 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38026 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-38026 · Security Note
• https://git.kernel.org/stable/c/d2062cc1b1c367d5d019f595ef860159e1301351 · Note
• https://git.kernel.org/linus/d2062cc1b1c367d5d019f595ef860159e1301351 · Note
• https://git.kernel.org/stable/c/26468ea864fecf496654459e52a6b7a7230bcb6d · Note
• https://twitter.com/CVEnew/status/1935274864103034998 · Twitter Post