What is the CVSS score of CVE-2025-38367?

CVE-2025-38367 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2025-38367?

A flaw in LoongArch KVM hypervisor kernel versions 6.16-rc1 through rc3 enables privilege escalation and system crashes when low-privileged users manipulate the virtual interrupt controller; no…. A patch is available.

How to fix or mitigate CVE-2025-38367?

Within 24 hours, identify all systems running mainline Linux 6.16 rc1-rc3 on LoongArch KVM hosts and isolate or restrict access to any discovered instances. Within 7 days, apply the available vendor patch to all affected systems or transition to patched kernel versions. Within 30 days, verify patch deployment across all LoongArch KVM infrastructure and implement monitoring for subsequent kernel releases.

Linux Kernel CVE-2025-38367

HIGH

Improper Validation of Array Index (CWE-129)

2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Linux Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local guest access with low privilege drives KVM EIOINTC emulation (AV:L, PR:L, AC:L, no UI); OOB kernel write yields high C/I/A within the host scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:26 vuln.today

CVE Published

Jul 25, 2025 - 13:15 nvd

HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Avoid overflow with array index

The variable index is modified and reused as array index when modify register EIOINTC_ENABLE. There will be array index overflow problem.

AnalysisAI

Local privilege escalation and denial of service in the Linux kernel's LoongArch KVM hypervisor arises from an array index overflow when handling writes to the EIOINTC_ENABLE register of the emulated extended I/O interrupt controller. Affecting mainline 6.16 release candidates (rc1-rc3) on LoongArch hosts, a low-privileged actor able to program the virtual interrupt controller can write out of the bounds of a kernel array, corrupting memory with high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS probability is low (0.14%, 4th percentile).

Technical ContextAI

The flaw lives in KVM's emulation of the LoongArch Extended I/O Interrupt Controller (EIOINTC), the on-chip interrupt routing hardware used by LoongArch (Loongson) CPUs. In the vulnerable code path the loop variable 'index' is mutated and then reused as an array index while servicing a guest write to the EIOINTC_ENABLE register, so the effective index can exceed the bounds of the backing array. This is a classic CWE-129 (Improper Validation of Array Index) defect, categorized by the intelligence tags as a Buffer Overflow, and it executes in kernel context on the hypervisor host rather than being contained to guest memory. Because it is reachable through the KVM device-emulation interface, the attack surface is the guest-to-host boundary on machines running LoongArch virtualization.

RemediationAI

Upstream fix available (commit); released patched version not independently confirmed - apply the kernel.org stable commits 080e8d2ecdfde588897aa8a87a8884061f4dbbbb and 2cc84c4b0d70d42e291862ecc848890d18e1004a, or upgrade to the final 6.16 release (or a stable point release) that incorporates them once your distribution ships it. Because the affected versions are 6.16 release candidates, the most practical remediation is to move off the rc kernel to a fixed mainline/stable build rather than run a pre-release in production. As a compensating control until patched, avoid running untrusted KVM guests on LoongArch hosts and restrict who can create or configure VMs (guest access to the EIOINTC emulation is the exploitation path); on non-LoongArch architectures no action specific to this CVE is required. The trade-off of blocking untrusted guests is reduced multi-tenant/virtualization flexibility on those hosts.

Same weakness CWE-129 – Improper Validation of Array Index

View all

CVE-2016-9053 CRITICAL POC

9.8

CVE-2020-27485 CRITICAL POC

9.9

CVE-2020-27483 CRITICAL POC

9.9

CVE-2024-24563 CRITICAL POC

9.8

CVE-2017-8797 HIGH

7.5

CVE-2018-11489 HIGH POC

8.8

CVE-2026-56770 HIGH POC

8.7

CVE-2017-7228 HIGH POC

8.2

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected

CVE-2025-38367 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-38367

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-129 – Improper Validation of Array Index

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code