What is the CVSS score of CVE-2025-38366?

CVE-2025-38366 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2025-38366?

LoongArch virtualization infrastructure running Linux kernel 6.16 rc1-rc3 contains a local privilege escalation vulnerability that could allow system-level attackers to compromise hosted virtual…. A patch is available.

How to fix or mitigate CVE-2025-38366?

Within 24 hours, audit all LoongArch systems to identify instances of Linux kernel 6.16 release candidates (rc1, rc2, rc3). Within 7 days, upgrade all affected hosts to the vendor-released patch (Linux kernel 6.16 final release or later). Within 30 days, complete deployment verification, document patch status in your asset inventory, and close this vulnerability in your tracking system.

Linux Kernel CVE-2025-38366

HIGH

2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Linux Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local KVM access (AV:L, PR:L) with a straightforward oversized-value trigger (AC:L); host kernel memory corruption yields high C/I/A within the host (S:U).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:27 vuln.today

CVE Published

Jul 25, 2025 - 13:15 nvd

HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Check validity of "num_cpu" from user space

The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about irqchip EIOINTC, here add validation about cpu number to avoid array pointer overflow.

AnalysisAI

Local privilege escalation and host memory corruption in the Linux kernel's LoongArch KVM hypervisor (6.16 release candidates rc1-rc3) arises because the EIOINTC virtual irqchip fails to validate a user-space-supplied 'num_cpu' value against EIOINTC_ROUTE_MAX_VCPUS, allowing an array pointer overflow. A local user with permission to create KVM virtual machines can trigger out-of-bounds access in host kernel memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and the issue was fixed upstream before the 6.16 final release.

Technical ContextAI

The flaw lives in the KVM (Kernel-based Virtual Machine) subsystem for the LoongArch architecture, specifically the emulation of the EIOINTC (Extended I/O Interrupt Controller) irqchip. When user-space VMM software (e.g., QEMU) configures the virtual interrupt controller via KVM ioctls, it supplies a 'num_cpu' value indicating the number of virtual CPUs to route interrupts for. The kernel used this value to index routing arrays without first checking it against the EIOINTC_ROUTE_MAX_VCPUS bound, so an oversized value causes an array pointer to overflow past its allocation. Although the NVD lists CWE as N/A, the intelligence tags correctly classify this as a Buffer Overflow / out-of-bounds access (CWE-787/CWE-125 class). CPE data confines the exposure to linux_kernel 6.16 rc1, rc2, and rc3, i.e., pre-release development kernels containing the LoongArch EIOINTC emulation code.

RemediationAI

Patch available per vendor advisory: upgrade to a Linux kernel build that includes the LoongArch KVM fix, applied via the stable-tree commits a3293b4078ee93174f70f36d3ab7618554ce6ab6 and cc8d5b209e09d3b52bca1ffe00045876842d96ae at https://git.kernel.org/stable/c/a3293b4078ee93174f70f36d3ab7618554ce6ab6 and https://git.kernel.org/stable/c/cc8d5b209e09d3b52bca1ffe00045876842d96ae; the fix adds bounds validation of user-supplied num_cpu against EIOINTC_ROUTE_MAX_VCPUS. Since only 6.16 release candidates are affected, running the final 6.16 release or any kernel carrying these commits resolves the issue. Where immediate patching is not possible, restrict access to /dev/kvm so only trusted, non-untrusted-tenant users can create VMs (this disables local virtualization for restricted users), and avoid exposing KVM to untrusted local workloads on LoongArch hosts; on non-LoongArch systems no action is required.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected

CVE-2025-38366 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-38366

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code