CVE-2025-38560

What it actually does

Cache coherency vulnerability in x86 SEV-SNP memory validation that fails to evict cache lines by touching first and last bytes of 4K pages during page state change to private unless COHERENCY_SFW_NO CPUID bit is set, enabling potential memory corruption.

Why it matters to the business

May allow unauthorized memory access or corruption in SEV-SNP protected VMs and containers on affected Linux kernels, increasing risk to virtualized workloads and privileged operations in cloud or container environments with moderate prevalence in downstream packages.

How an attack unfolds

Attacker identifies a vulnerable SNP guest without the CPUID mitigation bit, triggers page state changes to private, and leverages missing cache eviction to corrupt or access memory during validation; threat actors associated with Advanced Spyware Campaign and Linux Kernel Privilege Escalation in Container-Optimized OS have shown interest in similar kernel flaws.

How to fix it

Apply kernel patch from commit 1fec416c03d0a64cc21aa04ce4aa14254b017e6a or update affected packages to fixed versions including openjdk-17-openj9 0.53.0-r0 and equivalents; disable SNP if mitigation cannot be applied immediately.

How to confirm the fix worked

Verify presence of the cache eviction mitigation code in the kernel source, confirm CPUID bit handling, and test page state transitions on patched systems with SEV-SNP enabled.

Typical attack path

1. Reconnaissance for systems running vulnerable Linux kernel versions with SEV-SNP enabled
2. Trigger memory page state change from shared to private
3. Exploit absent cache line eviction to manipulate validated memory contents
4. Achieve memory corruption leading to privilege escalation within the guest or host

How to detect it

Review kernel logs and tracing for anomalous page state change events around SNP validation; correlate with threat actor campaigns involving Linux privilege escalation on container-optimized OS.

What your security team should do

• Patch Linux kernels supporting SEV-SNP to the listed fixed commits or package versions as highest priority
• Audit container and VM fleets for SNP usage and apply updates within standard change windows given low EPSS
• Enable kernel logging for page validation events to support future detection