Intra-host Migration Vulnerability in Linux Kernel Affecting KVM Virtual Machines

CVE-2025-38455

What is CVE-2025-38455?

A vulnerability in the Linux kernel's KVM module can cause a crash during intra-host migration of virtual machines when vCPU creation is in-flight. This occurs due to a race condition, where the SEV-ES state might be incorrectly set while managing multiple vCPUs. If the source or destination VM is creating a vCPU, the migration mechanism can fail, leading to issues such as a NULL VMSA page error. This can degrade the reliability and stability of virtual machines configured with SEV-ES, posing risks to data integrity.

References