Critical Vulnerability in Linux Kernel: KVM Hyper-V Non-Canonical Address Handling
Summary
DEBIAN-CVE-2025-38351: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALL_FLUSH_VIRTUAL_AD... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel's KVM (Kernel-based Virtual Machine) module allows users to run virtual machines on Linux. This vulnerability affects KVM guests with Hyper-V hypercalls enabled, where improper handling of non-canonical addresses can lead to system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the KVM module related to the handling of non-canonical guest virtual addresses (GVAs) during TLB (Translation Lookaside Buffer) flush operations. When hypercalls HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX are invoked, non-canonical GVAs can be passed without proper filtering. This oversight can lead to Intel's INVVPID signaling a VM-Fail, causing system warnings and potential crashes. AMD's INVLPGA ignores these addresses, but the lack of validation poses risks for system stability and security.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, avoid passing non-canonical guest virtual addresses during TLB flush operations. Ensure that guest systems are configured to filter out invalid addresses before invoking hypercalls.
Conclusion
The vulnerability in the Linux kernel's KVM module regarding non-canonical address handling poses significant risks to system stability and security. It is crucial to update to the patched versions of the Linux package to mitigate these risks. Implementing the recommended workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for linux →
FAQ
A non-canonical address is an address that does not conform to the expected format for virtual addresses in a given architecture, which can lead to errors when processed.
If non-canonical addresses are processed, it can trigger system warnings and potentially lead to crashes, especially on Intel processors.
No, this vulnerability is specific to certain versions of the Linux kernel that do not implement the necessary filtering for non-canonical addresses.
Implement the workaround by ensuring that non-canonical addresses are not passed during TLB flush operations until you can apply the patch.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application against vulnerabilities using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
