CVE-2025-37960

What it actually does

In the Linux kernel's memblock allocator, memblock_double_array() may use memory ranges returned by memblock_find_in_range() that have not been accepted via accept_memory() before the slab allocator is available, leading to crashes when accessing unaccepted memory in SNP guests.

Why it matters to the business

Systems running Linux kernels on AMD SEV-SNP enabled environments may experience boot failures or kernel panics, disrupting virtualization workloads and secure guest operations. The issue affects kernels prior to the fix commit.

How an attack unfolds

An attacker with the ability to boot an SNP guest on a vulnerable kernel can trigger the memblock_double_array path during early initialization, causing a memcpy on unaccepted memory and resulting in a crash.

How to fix it

Update the Linux kernel to the fixed version including commit 7bcd29181bab8d508d2adfdbb132de8b1e088698 or later stable releases that incorporate the accept_memory() call before using allocated ranges.

How to confirm the fix worked

Verify the kernel source includes the accept_memory() invocation in memblock_double_array() and test booting an SNP guest without crashes.

Typical attack path

1. Identify SNP-capable host
2. Configure and boot vulnerable guest
3. Trigger memblock allocation during init
4. Observe crash due to unaccepted memory access

How to detect it

Look for kernel panic logs mentioning memcpy_orig and memblock_double_array during boot of SNP guests; check dmesg or serial console for RIP pointing to early boot functions.

What your security team should do

• Prioritize patching Linux kernels in SNP environments
• Monitor for boot-time crashes in affected guests
• Apply the specific commit fix if building custom kernels