CVE-2025-38064

In the Linux kernel, the following vulnerability has been resolved:

virtio: break and reset virtio devices on device_shutdown()

Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang.

Invalid read at addr 0x102877002, size 2, region '(null)', reason: rejected
Invalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected
...

It was traced down to virtio-console. Kexec works fine if virtio-console is not in use.

The issue is that virtio-console continues to write to the MMIO even after underlying virtio-pci device is reset.

Additionally, Eric noticed that IOMMUs are reset before devices, if devices are not reset on shutdown they continue to poke at guest memory and get errors from the IOMMU. Some devices get wedged then.

The problem can be solved by breaking all virtio devices on virtio bus shutdown, then resetting them.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploiting it requires privileged access to execute a kexec kernel transition or system shutdown within a virtualized guest. In virtual machine environments, virtio devices may continue attempting memory access after the underlying device is reset during shutdown, resulting in host memory access rejections and guest system hangs. Because the issue only manifests during privileged guest teardown operations and does not allow unprivileged privilege escalation or remote code execution, the overall risk is contained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.