CVE-2025-38074 – This CVE describes a race condition vulnerabili... (How to Fix)

Q: What is the severity of CVE-2025-38074?

CVE-2025-38074 has a CVSS score of 5.5 (MEDIUM). This CVE describes a race condition vulnerability in the Linux kernel's vhost-scsi subsystem where the vhost thread may access freed memory when QEMU disables logging. This could allow a malicious QEMU instance or compromised VMM to cause memory corruption in the kernel, potentially leading to system crashes or privilege escalation. Systems using vhost-scsi with QEMU/KVM virtualization are affected.

📋 TL;DR

This CVE describes a race condition vulnerability in the Linux kernel's vhost-scsi subsystem where the vhost thread may access freed memory when QEMU disables logging. This could allow a malicious QEMU instance or compromised VMM to cause memory corruption in the kernel, potentially leading to system crashes or privilege escalation. Systems using vhost-scsi with QEMU/KVM virtualization are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using vhost-scsi with QEMU/KVM virtualization. Not all Linux installations use this configuration.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory corruption leading to privilege escalation, system crash, or arbitrary code execution in kernel context.

🟠

Likely Case

System instability, kernel panic, or denial of service due to invalid memory access.

🟢

If Mitigated

No impact if proper kernel patches are applied or vhost-scsi is not in use.

🌐 Internet-Facing: LOW - This requires local access to the host system or compromise of the VMM.

🏢 Internal Only: MEDIUM - Virtualization hosts running vulnerable kernels with vhost-scsi enabled could be affected by malicious or compromised VMs.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires race condition timing and access to control the VMM/QEMU instance. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: 59614c5acf6688f7af3c245d359082c0e9e53117, 80cf68489681c165ded460930e391b1eb37b5f6f, 8312a1ccff1566f375191a89b9ba71b6eb48a8cd, bd8c9404e44adb9f6219c09b3409a61ab7ce3427, c0039e3afda29be469d29b3013d7f9bdee136834

Vendor Advisory: https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable vhost-scsi

linux

Disable the vhost-scsi module if not required for your virtualization setup

echo 'blacklist vhost_scsi' >> /etc/modprobe.d/blacklist-vhost-scsi.conf
rmmod vhost_scsi

🧯 If You Can't Patch

Disable vhost-scsi module if not required for your virtualization workloads
Isolate virtualization hosts and restrict access to VMM management interfaces

🔍 How to Verify

Check if Vulnerable:

Check if vhost_scsi module is loaded: lsmod | grep vhost_scsi. If loaded and kernel version is before fix commits, system may be vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commits or verify vhost_scsi module is not loaded if disabled as workaround.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
Oops messages related to vhost_scsi
Memory corruption errors in kernel logs

SIEM Query:

source="kernel" AND ("vhost_scsi" OR "Oops" OR "general protection fault")

📊 Metadata

CVE ID: CVE-2025-38074

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.03% exploit probability (6.2th percentile)

Published: June 18, 2025

Last Updated: December 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON