CVE-2025-38283

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable path is driven entirely through local file operations on a VFIO device fd — `VFIO_DEVICE_FEATURE` migration-state ioctls plus `write()` on the migration fd — with no network-facing component.

AC:LAttack complexity, low

Triggering is fully deterministic: either leave the VF driver unloaded in the guest before migration, or simply open the device and perform STOP→RUNNING, since `vf_qm_state` defaults to `QM_READY` (0) from kzalloc. No race, timing window, or memory-layout condition is involved.

PR:LPrivileges required, low

An unprivileged local user granted access to /dev/vfio/* or /dev/iommu (the standard libvirt/QEMU delegation model) can reach the migration state machine; no capability is required on the IOMMU-backed path, as `CAP_SYS_RAWIO` gates only VFIO_NO_IOMMU mode.

UI:NUser interaction, none

The attacker performs every step themselves — open device, set RESUMING, write zeroed migration data, set STOP/RUNNING — with no action required from an administrator or any other user.

S:CScope, changed

Zeroed queue-context bases make the accelerator DMA against unintended addresses in the assigned domain, and the resulting device errors escalate through `qm_abnormal_irq()` to a PF `qm_controller_reset()` that calls `qm_try_stop_vfs()`, halting every sibling VF belonging to other VMs and the host's own crypto drivers — impact well beyond the attacker's own VFIO device.

C:HConfidentiality impact, high

With SQC/CQC/EQC bases set to zero the accelerator fetches queue contexts from IOVA 0 (guest physical page 0 in a typical no-vIOMMU passthrough) and follows those garbage descriptors, exposing memory never designated as queue storage through the device's queue and response path.

I:HIntegrity impact, high

The same bogus contexts cause the device to write CQEs/EQEs into arbitrary attacker-influenceable addresses in the DMA domain, silently corrupting a migrated VM's memory, while zeroed queue state is also committed into the physical VF's hardware configuration.

A:HAvailability impact, high

The NULL-address queue programming produces AXI/queue-invalid errors in the QM reset mask, which drive `qm_abnormal_irq()` → `qm_controller_reset()`, stopping the PF and all VFs — a full accelerator outage for the host and every VM using that device, in addition to failing the migration.