CVE-2025-38351: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38351 is a denial-of-service vulnerability in the Linux kernel's KVM subsystem affecting systems with Hyper-V hypercalls enabled. When processing HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST or HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX hypercalls, the kernel fails to filter non-canonical guest virtual addresses (GVAs) before passing them to hardware TLB invalidation instructions. On Intel systems, this causes INVVPID to signal VM-Fail and triggers a WARN_ONCE in invvpid_error(), potentially destabilizing the host. Affected Linux kernel versions span 6.2 through 6.6.102, 6.7 through 6.12.40, and 6.13 through 6.15.6 (including 6.16-rc1 through rc5). The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, IBM Advisory).

The root cause is missing input validation (CWE-20) in the KVM Hyper-V PV TLB flush path: non-canonical GVAs supplied by a guest are passed unchecked to vmx_flush_tlb_gva() on Intel, which invokes INVVPID — an instruction that explicitly faults on non-canonical addresses. AMD's INVLPGA silently ignores such addresses (no-op), so the issue is Intel-specific in practice. The call chain is: kvm_hv_vcpu_flush_tlb → vmx_flush_tlb_gva → invvpid_error() WARN_ONCE. The fix adds a canonicality check to skip invalid GVAs before issuing the hardware instruction, consistent with Hyper-V documentation stating that GVAs beyond a partition's GVA space should be ignored (Feedly, Kernel Patch).

A low-privileged local attacker operating within a KVM guest with Hyper-V hypercalls enabled can trigger repeated INVVPID failures on the Intel host, producing kernel WARN_ONCE messages and potential VM instability or crashes. The impact is limited to availability — there is no confidentiality or integrity compromise. The affected scope is the host kernel's KVM subsystem; lateral movement beyond the guest/host boundary is not a direct consequence of this vulnerability (Feedly).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges inside a KVM guest that has Hyper-V hypercalls enabled, limiting the practical attack surface (Feedly).

1. Precondition: Obtain low-privileged access to a KVM guest running on an Intel host where Hyper-V hypercalls (kvm_intel with Hyper-V enlightenments) are enabled.
2. Craft hypercall: Issue a HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST or HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX Hyper-V hypercall from within the guest, populating the GVA list parameter with one or more non-canonical addresses (e.g., 0xaaaaaaaaaaaaa000 — an address with bits above the canonical boundary set).
3. Trigger INVVPID failure: The unpatched kernel passes the non-canonical GVA to vmx_flush_tlb_gva(), which executes INVVPID; Intel hardware signals VM-Fail, causing invvpid_error() to fire a WARN_ONCE in the host kernel.
4. Achieve DoS: Repeated invocations can generate kernel warnings and may destabilize the KVM VM or the host, resulting in a denial-of-service condition (Feedly).

• Logs: Host kernel logs (dmesg / /var/log/kern.log) containing entries such as invvpid failed: ext=0x0 vpid=<N> gva=0x<non-canonical-address> followed by WARNING: CPU: <N> PID: <N> at arch/x86/kvm/vmx/vmx.c:482 invvpid_error.
• Process: Unusual or repeated KVM vCPU run activity (kvm-vm process) associated with the warning, visible in kernel stack traces referencing vmx_flush_tlb_gva, kvm_hv_vcpu_flush_tlb, and kvm_arch_vcpu_ioctl_run.
• System: Unexpected VM instability or crashes on Intel KVM hosts running kernel versions 6.2–6.6.102, 6.7–6.12.40, or 6.13–6.15.6 with Hyper-V enlightenments enabled (Feedly).

Apply the patched Linux kernel versions: 6.6.103+, 6.12.41+, or 6.15.7+ as appropriate for your stable branch. Upstream patches are available in the kernel stable tree (Kernel Patch). Distribution-specific updates have been released by Red Hat (RHSA-2025:17377, RHSA-2025:18318, RHSA-2025:21469), Debian (DSA-5975-1, linux 6.12.41), Ubuntu (USN-7879-1/2/3/4, USN-7880-1, USN-7934-1), AlmaLinux (ALSA-2025-17377), SUSE, and Oracle Linux. IBM has also addressed this in IBM Db2 on Cloud Pak for Data (IBM Advisory). As a temporary workaround where patching is not immediately possible, consider disabling Hyper-V enlightenments in KVM guest configurations or restricting low-privileged guest access.