Critical Cleanup Logic Vulnerability in Linux Kernel: KVM x86/xen Package
Summary
DEBIAN-CVE-2025-38469: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for mor... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports various functionalities, including process management, memory management, and device drivers. This vulnerability specifically affects the KVM (Kernel-based Virtual Machine) component, which enables virtualization on Linux systems, allowing multiple operating systems to run concurrently on a single physical machine. The vulnerability arises from improper cleanup logic in the emulation of Xen schedop poll hypercalls, potentially leading to resource leaks or system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the KVM component related to the emulation of Xen schedop poll hypercalls. The issue occurs when the function kvm_xen_schedop_poll performs a kmalloc_array() for multiple event channels (nr_ports > 1). The error handling paths do not correctly route through the designated cleanup label, leading to potential memory leaks or undefined behavior. This flaw could be exploited by an attacker to disrupt the operation of virtual machines or cause system crashes, impacting overall system reliability and security.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider limiting the number of event channels (nr_ports) to one, thereby avoiding the conditions that trigger the vulnerability. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The identified vulnerability in the Linux kernel's KVM component poses significant risks to system stability and security. Users are strongly encouraged to update their packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper cleanup logic in the KVM component of the Linux kernel, which can lead to memory leaks and system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
Exploitation of this vulnerability could lead to resource leaks, system crashes, or instability in virtual machines running on the affected Linux kernel.
Yes, patched versions of the Linux kernel are available. Users should update to version 6.12.41-1 for Debian 13 and 6.16.3-1 for Debian 14.
As a temporary measure, consider limiting the number of event channels to one to avoid triggering the vulnerability, but plan to update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
