CVE-2025-38158

What it actually does

Incorrect assembly of DMA addresses for EQE and AEQE from hardware registers after VM migration in hisi_acc_vfio_pci, plus failure to update addresses when migrating guests from kernels using an old magic number, resulting in invalid addresses and guest kernel-mode encryption service failures.

Why it matters to the business

Disrupts encrypted workloads in virtualized Linux environments during live migration on affected hardware, increasing downtime risk and operational costs for organizations relying on kernel stability; widespread Linux kernel usage amplifies exposure across servers and cloud deployments.

How an attack unfolds

An attacker with control over VM migration in a hisi_acc_vfio_pci environment triggers a migration from an old kernel or post-fix kernel, causing the driver to produce wrong DMA addresses that break guest encryption; listed threat actors and related privilege escalation campaigns could leverage migration paths in targeted Linux kernel environments.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit 809a9c10274e1bcf6d05f1c0341459a425a4f05f or apply the equivalent stable patch; for freecad on Mageia 8 update to 0.18.6-1.3.mga8. Verify the fix is present before performing migrations involving mixed kernel versions.

How to confirm the fix worked

Confirm the presence of the corrected address combination logic and magic number handling in the hisi_acc_vfio_pci driver source or running kernel; test migration of a guest from an older kernel and verify DMA addresses remain valid with no encryption failures.

Typical attack path

1. Identify target systems using hisi_acc_vfio_pci with live migration enabled
2. Initiate or coerce a VM migration involving an older kernel guest
3. Exploit the incorrect register address combination or missing magic number update
4. Induce encryption service failure or data corruption in the guest

How to detect it

Review kernel logs and VFIO migration traces for DMA address errors or guest encryption failures around migration events; correlate with hisi_acc driver activity and check for unexpected service disruptions in encrypted workloads.

What your security team should do

• Prioritize kernel updates on all systems using hisi_acc_vfio_pci before the next migration window
• Audit virtualization setups for mixed old/new kernel guests and enforce consistent kernel versions
• Monitor migration logs for DMA or encryption errors as an interim detection measure
• Review downstream dependent packages and rebuild any custom kernels incorporating the fix