CVE-2025-37936

What it actually does

Improper masking of MSR_IA32_PEBS_ENABLE when generating values for VM-Entry allows PEBS to remain enabled for KVM guests even when the guest vCPU has not requested it, resulting in unexpected page faults (typically at address 0) and guest crashes when DS_AREA is unset.

Why it matters to the business

Virtualized workloads on affected older Linux kernels may experience sudden guest crashes during host-side performance monitoring, causing service interruptions; limited to specific legacy Ubuntu AWS packages with low ecosystem prevalence and no confirmed ransomware or KEV usage.

How an attack unfolds

A host-side perf tool (such as older perf kvm top) creates a guest-only PEBS event; intel_guest_get_msrs misinterprets the event and loads an unmasked PEBS_ENABLE value on VM-Entry, enabling PEBS for the guest and triggering repeated #PFs; related threat actors in Linux kernel privilege-escalation campaigns could leverage similar perf/KVM misconfigurations though this specific flaw is not confirmed exploited.

How to fix it

Upgrade the linux-aws package on Ubuntu Pro 14.04 LTS to version 4.4.0-1138.144; apply the update across all affected hosts and reboot into the fixed kernel.

How to confirm the fix worked

Confirm the running kernel reports version 4.4.0-1138.144 or newer, then execute perf kvm operations while monitoring for PEBS-induced faults in guest dmesg or KVM logs.

Typical attack path

1. Run a vulnerable perf userspace tool on the host that creates guest-only PEBS events
2. Trigger KVM VM-Entry so intel_guest_get_msrs generates the MSR value
3. Guest receives PEBS enabled without DS_AREA configured
4. CPU generates continuous page faults leading to guest crash or denial of service

How to detect it

Search KVM and kernel logs for repeated page faults at address zero during guest execution, unexpected PEBS MSR writes on VM-Entry, or guest crashes triggered by perf kvm tooling.

What your security team should do

• Prioritize patching legacy Ubuntu 14.04 AWS instances within the next maintenance window
• Restrict untrusted use of perf on hosts running KVM guests
• Monitor VM stability metrics and kernel logs for unexpected page-fault storms