CVE-2025-38508: 
Linux Ubuntu vulnerability analysis and mitigation

A vulnerability in the Linux kernel (CVE-2025-38508) was identified related to the Secure TSC frequency calculation in x86/sev systems. The issue was discovered and published to the CVE List on August 16, 2025, affecting Linux kernel systems using SEV-SNP VMs (NVD CVE).

The vulnerability stems from a discrepancy in the GUESTTSCFREQ MSR reporting, which bases frequency calculations on the nominal P0 frequency. This creates a deviation of approximately 0.2% from the actual mean TSC frequency due to clocking parameters. The issue manifests in the guest kernel's reliance on the reported nominal frequency for TSC-based timekeeping, while the actual frequency set during SNPLAUNCHSTART differs (Debian Tracker).

Over extended VM uptime, the frequency discrepancy accumulates, resulting in clock skew between the hypervisor and SEV-SNP VM. This leads to early timer interrupts as perceived by the guest and causes inaccurate time calculations, affecting the system's timekeeping reliability (NVD CVE).

The vulnerability has been resolved by utilizing the TSCFACTOR from the SEV firmware's secrets page to calculate the mean TSC frequency. The fix implements earlyioremapencrypted() to map the secrets page, as ioremapencrypted() uses kmalloc() which is not available during early TSC initialization. Fixed versions are available in various Linux distributions, including Debian bullseye (5.10.237-1), bookworm (6.1.147-1), and trixie (6.12.41-1) (Debian Tracker).