Database/Firmware, BMC & network fabric
Linux KVM/SVM - SEV/SEV-ES intra-host migration during vCPU creation: KVM permitted SEV/SEV-ES intra-host migration
Impact
KVM permitted SEV/SEV-ES intra-host migration while vCPU creation was still in flight, producing a race on confidential-VM state. Migration racing against vCPU setup means encrypted vCPU state can be moved or referenced while half-built - a route to host memory corruption driven from the VM lifecycle path.
Who can reach it
Through the KVM ioctl interface used for migration, reachable by the VMM process - so a compromised orchestrator or VMM.
What to do
Fixed in the Linux kernel. Take the distro kernel update (RHEL/Rocky, Ubuntu, SLES) and reboot the host - no firmware, VBIOS or AGESA step. On a GPU fleet this is a cordon, drain and rolling reboot; plan it as normal kernel maintenance. Interim control: disable intra-host migration for SEV guests in your VMM configuration.
References
Related entries
- Dell iDRAC Service Module (iSM): Buffer access with incorrect length in the in-band agent gives a low-privileged localCVE-2025-38743 · Dell iDRAC Service Module (iSM)High
- Linux bnxt_en driver (ring defaults vs traffic classes on ifdown): Memory corruption when firmware resources changeCVE-2025-39810 · Linux bnxt_en driver (ring defaults vs traffic classes on ifdown)High
- Linux kernel (drivers/infiniband/sw/rxe): Use-after-free from a race between a busy soft-RoCE task and its ownCVE-2025-40061 · Linux kernel (drivers/infiniband/sw/rxe)High
- The Linux kernel's IPMI driver message-handling layer: A use-after-free in a kernel driver reachable from the host'sCVE-2025-40202 · The Linux kernel's IPMI driver message-handling layerHigh
- Eaton UPS Companion (EUC) executable - library loading: Insecure library loading in the shipped executable givesCVE-2025-67450 · Eaton UPS Companion (EUC) executable - library loadingHigh
- Linux kernel (drivers/infiniband/sw/rxe): Two failed shared-receive-queue resizes in a row panic the node. The firstCVE-2025-68379 · Linux kernel (drivers/infiniband/sw/rxe)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.