CVE-2025-54566: 
NixOS vulnerability analysis and mitigation

CVE-2025-54566 is a migration state inconsistency vulnerability in QEMU's PCIe SR-IOV (Single Root I/O Virtualization) implementation, specifically in hw/pci/pcie_sriov.c. It affects QEMU through version 10.0.3 and is related to a previously disclosed issue tracked as CVE-2024-26327. The vulnerability was published on July 25, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, with an adjacent-network attack vector (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-642 (External Control of Critical State Data), arising from a migration state inconsistency in QEMU's SR-IOV PCI subsystem (hw/pci/pcie_sriov.c). During VM live migration, the SR-IOV state is not properly validated or synchronized, allowing an attacker on an adjacent network to influence critical state data. The upstream fix was committed to the QEMU project repository at commit cad9aa6fbdccd95e56e10cfa57c354a20a333717 (Red Hat Bugzilla, QEMU Commit). The issue was originally reported via the QEMU developer mailing list in July 2025.

Successful exploitation can result in low-level integrity compromise and limited availability disruption of the affected QEMU virtualization host. An attacker positioned on an adjacent network could manipulate PCIe SR-IOV migration state, potentially causing inconsistent device state across migrated VMs or disrupting VM availability. Confidentiality is not directly impacted, and the scope is limited to the affected system without privilege escalation (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires adjacent network access and specific conditions related to VM live migration with SR-IOV devices (Red Hat Advisory, Red Hat Bugzilla).

The upstream QEMU project has released a fix via commit cad9aa6fbdccd95e56e10cfa57c354a20a333717; users should update to a patched QEMU version beyond 10.0.3 as soon as vendor-specific packages become available. Red Hat has acknowledged the issue and is tracking it for affected products (e.g., qemu-kvm). As interim mitigations: restrict network access to virtualization hosts, implement strong network segmentation to limit adjacent-network exposure, and monitor for unusual PCIe device migration behaviors. Debian and SUSE have also issued updated QEMU packages addressing this CVE (Red Hat Bugzilla, Red Hat Advisory).

Red Hat has filed a security bug and is actively tracking the issue for its qemu-kvm packages, with multiple product security engineers assigned. Debian issued DSA-5983-1 and SUSE released updated QEMU packages addressing this CVE. Microsoft's Security Response Center also published a reference entry for this CVE. No significant public researcher commentary or social media discussion has been identified beyond standard vendor tracking (Red Hat Bugzilla, Red Hat Advisory).