CVE-2025-38064

What it actually does

Virtio devices on the virtio bus are not broken and reset during device_shutdown, allowing continued MMIO writes after the underlying virtio-pci device is reset and after IOMMU reset, resulting in invalid memory accesses and device hangs.

Why it matters to the business

Systems using virtio devices such as virtio-console may hang during reboot or kexec operations, causing unplanned downtime and complicating maintenance or recovery in virtualized environments.

How an attack unfolds

An attacker with the ability to trigger or observe shutdown sequences in a guest VM can cause or witness device state corruption when virtio devices continue DMA after reset; the provided threat actor references point to related kernel privilege-escalation campaigns that could chain this stability issue during targeted operations.

How to fix it

Update the Linux kernel to the fixed commit aee42f3d57bfa37b2716df4584edeecf63b9df4c or later stable releases that break and reset all virtio devices on virtio bus shutdown; for affected packages such as xfsprogs on Mageia 5, upgrade to 3.2.4-1.mga5 or equivalent.

How to confirm the fix worked

Confirm the presence of commit aee42f3d57bfa37b2716df4584edeecf63b9df4c in the running kernel source; test kexec with virtio-console enabled and verify no invalid memory access reports from QEMU or IOMMU errors in dmesg.

Typical attack path

1. Obtain local or guest access to a Linux system using virtio devices
2. Trigger or wait for a shutdown or kexec sequence
3. Virtio devices perform unauthorized MMIO or DMA after reset
4. Observe or induce kernel hang or IOMMU faults

How to detect it

Review kernel logs and hypervisor console output for invalid memory access or rejected MMIO operations during shutdown; correlate with virtio-console usage and IOMMU fault entries around kexec events.

What your security team should do

• Prioritize kernel updates on all systems using virtio devices, especially those performing frequent kexec or live migration
• Monitor EPSS trend and re-evaluate if new exploit maturity emerges
• Include virtio shutdown behavior in VM hardening and reboot testing procedures