Linux kernel (drivers/vfio/pci/hisilicon): The VFIO migration driver reassembled the device's event-queue DMA addresses

CVSS 5.5CVE-2025-38158Kernel, userspace & hypervisorcurated

Impact

The VFIO migration driver reassembled the device's event-queue DMA addresses from hardware registers in the wrong byte order, so after a live migration the accelerator was programmed to DMA at addresses that were never the ones the guest set up. The device ends up writing to the wrong place inside the assigned domain and the guest's crypto services fail; the same class of mistake in an address-composition path is what turns a migration into a stray-DMA event, and the fix has to carry a magic-number check because guests migrated from old kernels otherwise land on bad addresses silently.

Who can reach it

Not attacker-initiated: triggered by live-migrating a guest that has a HiSilicon accelerator VF assigned under hisi_acc_vfio_pci, including migrations from an older kernel to a newer one. The resulting DMA is still bounded by the guest's IOMMU domain, so this is corruption and device malfunction inside the tenant rather than a host escape. Conditional on hisi_acc_vfio_pci being bound and live migration being in use - not reachable on an NVIDIA/AMD GPU fleet that never loads this driver.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel on nodes using hisi_acc_vfio_pci, and patch source and destination hosts together so the migration magic-number handling matches. Interim: disable live migration for HiSilicon accelerator VFs.

References

https://git.kernel.org/stable/c/809a9c10274e1bcf6d05f1c0341459a425a4f05f https://git.kernel.org/stable/c/f0423873e7aeb69cb68f4e8fa3827832e7b037ba https://nvd.nist.gov/vuln/detail/CVE-2025-38158

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.