CVE-2025-38469

What it actually does

Improper error handling after kmalloc_array in kvm_xen_schedop_poll causes control flow to bypass the out label on kvm_read_guest_virt failure, resulting in use of uninitialized memory or leaked kernel allocations during Xen schedop poll hypercall emulation.

Why it matters to the business

Guest VMs can trigger kernel memory corruption on hosts using Xen-on-KVM, leading to crashes, denial of service, or local privilege escalation in virtualized Linux environments; high prevalence in upstream kernel trees increases exposure for cloud and enterprise deployments.

How an attack unfolds

An attacker with guest access crafts a schedop poll hypercall requesting multiple event channels (nr_ports > 1), triggers the kmalloc path, then forces an error in kvm_read_guest_virt so execution skips the required cleanup label, corrupting kernel memory structures that can be leveraged for privilege escalation or further attacks.

How to fix it

Apply the upstream fix commit 3ee59c38ae7369ad1f7b846e05633ccf0d159fab or later; rebuild and deploy the patched kernel; for Debian 13/14 systems update libssh packages to 0.11.2-1 once the dependency chain is resolved.

How to confirm the fix worked

Confirm kernel source contains commit 3ee59c38ae7369ad1f7b846e05633ccf0d159fab; run targeted hypercall fuzzing or unit tests exercising kvm_xen_schedop_poll error paths; verify no kmalloc leaks via kmemleak after hypercall sequences.

Typical attack path

1. Obtain code execution inside a KVM guest configured with Xen emulation
2. Issue Xen schedop poll hypercall with nr_ports > 1
3. Arrange for kvm_read_guest_virt to fail after kmalloc_array
4. Trigger subsequent use of the improperly cleaned allocation to corrupt kernel memory
5. Escalate to host privileges or cause denial of service

How to detect it

Review kernel logs for Xen schedop poll related oops or warnings; inspect dmesg and audit logs around hypercall emulation failures; correlate with guest activity showing repeated multi-port poll attempts; search for memory-leak reports tied to kvm_xen_schedop_poll.

What your security team should do

• Prioritize patching kernel packages on all Xen-on-KVM hosts within 30 days given active exploitation campaigns targeting similar kernel CVEs
• Audit guest configurations for Xen emulation usage and restrict hypercall interfaces where possible
• Enable kernel memory debugging and logging for hypercall paths in production
• Monitor EPSS trend and threat actor activity for related privilege-escalation chains