CVE-2025-38508: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38508 is a vulnerability in the Linux kernel's x86 SEV (Secure Encrypted Virtualization) subsystem related to incorrect TSC (Time Stamp Counter) frequency calculation in SEV-SNP virtual machines. The flaw causes clock skew between the hypervisor and SEV-SNP guests due to the GUEST_TSC_FREQ MSR reporting a nominal P0 frequency that deviates ~0.2% from the actual mean TSC frequency, leading to early timer interrupts (hrtimer misfires) and potential guest kernel panics during early TSC initialization. Affected versions include Linux kernel 6.14 through 6.15.6, as well as release candidates 6.16-rc1 through 6.16-rc4. It was published on August 16, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is an improper calculation of the Secure TSC frequency in SEV-SNP guests (CWE-682: Incorrect Calculation). The GUEST_TSC_FREQ MSR provides a nominal P0 frequency that does not account for actual clocking parameters set during SNP_LAUNCH_START, resulting in a ~0.2% discrepancy that accumulates over extended VM uptime and causes clock skew. Additionally, the original code used ioremap_encrypted() to map the SEV firmware secrets page, which internally calls kmalloc() — unavailable during early TSC initialization — triggering a kernel panic. The fix applies the TSC_FACTOR value from the SEV firmware's secrets page (as defined in the SNP Firmware ABI Specification) to compute the accurate mean TSC frequency, and replaces ioremap_encrypted() with early_ioremap_encrypted() to avoid the panic (Red Hat CVE, Kernel Patch 1, Kernel Patch 2).

The primary impact is an availability issue (CVSS availability impact: High) affecting SEV-SNP virtual machines running on vulnerable kernel versions. Over extended uptime, the accumulated clock skew causes hrtimers to fire earlier than expected, disrupting time-sensitive workloads and potentially causing guest kernel panics during early boot due to the improper use of kmalloc() in early initialization. There is no confidentiality or integrity impact; the vulnerability is confined to the guest VM's timekeeping subsystem and does not enable privilege escalation or data exfiltration (Red Hat CVE, Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2025-38508. The vulnerability requires local access with low privileges (CVSS: AV:L/AC:L/PR:L) and is limited to environments using AMD SEV-SNP with Secure TSC enabled. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Red Hat CVE).

The vulnerability is patched in Linux kernel version 6.15.7 and the 6.16 mainline release. Two upstream commits address the issue: 52e1a03e6cf6 and d0195c42e658 in the stable kernel tree. Users running SEV-SNP workloads on affected kernel versions (6.14–6.15.6 or 6.16-rc1 through rc4) should upgrade to kernel 6.15.7 or later. Ubuntu has issued security notices USN-7879-1 through USN-7879-4, USN-7880-1, and USN-7934-1 addressing this CVE for affected Ubuntu releases (Ubuntu USN-7879-1, Ubuntu USN-7934-1, Kernel Patch 1).