KVM CPU Soft Lockup Vulnerability in Linux Kernel - CVE-2025-38506
Summary
DEBIAN-CVE-2025-38506: In the Linux kernel, the following vulnerability has been resolved: KVM: Allow CPU to reschedule while setting per-page memory attributes When running an SEV-SNP guest with a sufficiently large amount of memory (1TB+), t... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system and is critical for system stability and performance. This vulnerability affects the kernel's KVM (Kernel-based Virtual Machine) functionality, specifically when handling memory attributes for SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) guests with large memory allocations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that allows the CPU to experience soft lockups when setting per-page memory attributes for SEV-SNP guests with large memory (1TB+). This occurs in the kvm_vm_set_mem_attributes() function, where the host may become unresponsive due to prolonged execution without yielding control to the scheduler. The issue can lead to significant performance degradation and system instability, as evidenced by watchdog messages indicating CPU lockups.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While a specific workaround is not detailed, it is advisable to monitor the system's memory management and avoid configurations that lead to excessive memory allocation for SEV-SNP guests until the patch is applied.
Conclusion
The CVE-2025-38506 vulnerability in the Linux kernel poses a risk of CPU soft lockups during memory attribute management for large SEV-SNP guests. It is crucial to apply the available patches to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38506 is a vulnerability in the Linux kernel that can cause CPU soft lockups when managing memory attributes for large SEV-SNP guests.
This vulnerability can lead to system instability and performance issues, particularly in environments utilizing KVM for virtualization with large memory allocations.
Yes, patches are available for Debian 13 and 14. Ensure your system is updated to the specified patched versions.
Monitor your system closely for performance issues and consider adjusting memory configurations for SEV-SNP guests as a temporary measure.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
