In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] defines the COHERENCY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCY_SFW_NO bit is not set, indicating the SNP guest is vulnerable.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/1fb873971e23c35c53823c62809a474a92bc3022 cve-icon cve-icon
https://git.kernel.org/stable/c/1fec416c03d0a64cc21aa04ce4aa14254b017e6a cve-icon cve-icon
https://git.kernel.org/stable/c/7b306dfa326f70114312b320d083b21fa9481e1e cve-icon cve-icon
https://git.kernel.org/stable/c/a762a4c8d9e768b538b3cc60615361a8cf377de8 cve-icon cve-icon
https://git.kernel.org/stable/c/aed15fc08f15dbb15822b2a0b653f67e76aa0fdf cve-icon cve-icon
https://git.kernel.org/stable/c/f92af52e6dbd8d066d77beba451e0230482dc45b cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025081906-CVE-2025-38560-d265@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-38560 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-38560 cve-icon
History

Thu, 21 Aug 2025 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Wed, 20 Aug 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Tue, 19 Aug 2025 17:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] defines the COHERENCY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCY_SFW_NO bit is not set, indicating the SNP guest is vulnerable.
Title x86/sev: Evict cache lines during SNP memory validation
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-08-19T17:02:37.792Z

Reserved: 2025-04-16T04:51:24.025Z

Link: CVE-2025-38560

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-08-19T17:15:32.370

Modified: 2025-08-20T14:40:17.713

Link: CVE-2025-38560

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-08-19T00:00:00Z

Links: CVE-2025-38560 - Bugzilla