CVE-2025-38625

What it actually does

Missing detach_ioas callback in vfio_device_ops for pds_vfio_pci driver causes WARN_ON in __vfio_register_dev and probe failure (-EINVAL) when CONFIG_IOMMUFD is enabled.

Why it matters to the business

Systems relying on pds_vfio_pci devices under IOMMUFD configurations experience driver initialization failures, blocking VFIO device attachment and related virtualization or hardware passthrough workloads; prevalence in Linux distributions and container images increases operational risk.

How an attack unfolds

No attacker exploitation is possible; the issue is a benign driver registration failure during module load or device binding. Listed threat actors reference unrelated privilege-escalation CVEs and do not apply.

How to fix it

Update Linux kernel to commit 7dbfae90c5a33f6b694e7068bc9522cc2655373d or later; for Chainguard packages upgrade openjdk-11-openj9* to 0.53.0-r0. Rebuild and reboot systems using affected pds_vfio_pci configurations.

How to confirm the fix worked

Confirm presence of vfio_iommufd_physical_detach_ioas assignment in pds_vfio_pci vfio_device_ops after update; attempt device bind under CONFIG_IOMMUFD and verify successful probe without WARN_ON.

Typical attack path

1. Load pds_vfio_pci driver with CONFIG_IOMMUFD enabled
2. Bind device to driver
3. vfio_register_dev calls unset detach_ioas pointer
4. Kernel emits WARN_ON and returns -EINVAL, aborting probe

How to detect it

Review kernel logs for the exact WARN_ON at drivers/vfio/vfio_main.c:317 and probe failure messages containing pds_vfio_pci; no post-exploitation artifacts exist because the condition prevents driver attachment.

What your security team should do

• Prioritize kernel and package upgrades within 30 days given 431 days since publication and slight EPSS increase
• Audit IOMMUFD-enabled hosts for pds_vfio_pci usage and schedule maintenance windows
• Monitor vendor advisories for backported fixes in distribution kernels