In the Linux kernel, the following vulnerability has been resolved:
x86/sev: Evict cache lines during SNP memory validation
An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation.
CPUID bit Fn8000001FEBX[31] defines the COHERENCYSFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed.
Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCYSFWNO bit is not set, indicating the SNP guest is vulnerable.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-1032cfa1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"140723014718515970609396044434420815682",
"14523072751488706541357951368216153234",
"221191538104339766805141375363132129506",
"226447587976092394573927084667896621649"
]
},
"target": {
"file": "arch/x86/boot/startup/sev-shared.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"id": "CVE-2025-38560-17d020ef",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
},
"target": {
"function": "get_cpuflags",
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fec416c03d0a64cc21aa04ce4aa14254b017e6a",
"id": "CVE-2025-38560-1b876973",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319333414944196741658838000084609720210",
"317710627093446876424901491428383278456",
"70860687523509800662993071287735032619",
"1326096377756701478464482202226945065"
]
},
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-2b12d110",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233902922935257256151778042838037574552",
"54192453191850719379707703564964518831",
"280431694015177591697824716047159989018",
"139993279964610683532623488920246456538",
"2387699097212628135533096810422110206",
"246587325069208931881605630277702438595",
"115479908301602173578573016025004657934",
"69297341997945733718460636254882179424"
]
},
"target": {
"file": "arch/x86/coco/sev/core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"id": "CVE-2025-38560-2e238b9d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
},
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-302f18da",
"digest": {
"function_hash": "288328066503986913630476792604508096028",
"length": 106.0
},
"target": {
"function": "pvalidate_pages",
"file": "arch/x86/coco/sev/core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-31c3a2be",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
},
"target": {
"function": "get_cpuflags",
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-33d1cb37",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
},
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fec416c03d0a64cc21aa04ce4aa14254b017e6a",
"id": "CVE-2025-38560-3bd06fa4",
"digest": {
"function_hash": "7080891552781308824176504642458698700",
"length": 593.0
},
"target": {
"function": "__page_state_change",
"file": "arch/x86/boot/compressed/sev.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-3f504f1c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"270172561786410787974324281980039040681",
"139126940183969138903067580270677011061",
"40404752158047755676411923744547965694",
"100595675648875436320419001049689734169"
]
},
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-41d9666a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233902922935257256151778042838037574552",
"54192453191850719379707703564964518831",
"280431694015177591697824716047159989018",
"139993279964610683532623488920246456538",
"2387699097212628135533096810422110206",
"246587325069208931881605630277702438595",
"115479908301602173578573016025004657934",
"69297341997945733718460636254882179424"
]
},
"target": {
"file": "arch/x86/coco/sev/core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"id": "CVE-2025-38560-45676484",
"digest": {
"function_hash": "288328066503986913630476792604508096028",
"length": 106.0
},
"target": {
"function": "pvalidate_pages",
"file": "arch/x86/coco/sev/shared.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-6407c6d2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"270172561786410787974324281980039040681",
"139126940183969138903067580270677011061",
"40404752158047755676411923744547965694",
"100595675648875436320419001049689734169"
]
},
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fec416c03d0a64cc21aa04ce4aa14254b017e6a",
"id": "CVE-2025-38560-6503da49",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164503145186339353175166653279488690951",
"30116641684862932255204599860725612821",
"100695254755424891331737251556299828854",
"279775754994235260925422618058150027065"
]
},
"target": {
"file": "arch/x86/boot/compressed/sev.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-7cc83eac",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
},
"target": {
"function": "get_cpuflags",
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-882d5a57",
"digest": {
"function_hash": "32663086915179879701273440917758037044",
"length": 276.0
},
"target": {
"function": "pvalidate_4k_page",
"file": "arch/x86/boot/startup/sev-shared.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-89e68f71",
"digest": {
"function_hash": "32663086915179879701273440917758037044",
"length": 276.0
},
"target": {
"function": "pvalidate_4k_page",
"file": "arch/x86/boot/startup/sev-shared.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-8c91441c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"140723014718515970609396044434420815682",
"14523072751488706541357951368216153234",
"221191538104339766805141375363132129506",
"226447587976092394573927084667896621649"
]
},
"target": {
"file": "arch/x86/boot/startup/sev-shared.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fec416c03d0a64cc21aa04ce4aa14254b017e6a",
"id": "CVE-2025-38560-9edd35b6",
"digest": {
"function_hash": "220981835791860961109946826684313798175",
"length": 432.0
},
"target": {
"function": "pvalidate_pages",
"file": "arch/x86/kernel/sev.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"id": "CVE-2025-38560-9f3ca5eb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232598209466559849660357943223553938505",
"149690585875036078330306635460241972092",
"188885801923205867213134367583336807515",
"189585808096342126924934796378189070094",
"128838392430848103933475761973894331676",
"317708181830295859258993560426695473586",
"287881622879181507892190205842106992370"
]
},
"target": {
"file": "arch/x86/include/asm/sev.h"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fec416c03d0a64cc21aa04ce4aa14254b017e6a",
"id": "CVE-2025-38560-a9752d0b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
},
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"id": "CVE-2025-38560-b69530c9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113302280571249228799993000574717352351",
"151584611480411124950860580961520804928",
"15494435544886361202746068065562742188",
"100595675648875436320419001049689734169"
]
},
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"id": "CVE-2025-38560-ce228dbf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"105122229636331257663554586754397953709",
"308338381791112539748151015159464701208",
"294913771912601159530181182700305806728",
"313244894893371976322354755446634537923",
"295776850403428643653744672437525127205",
"154924550083155090256333034377084294645",
"119837980791761331798734799023397649874",
"233902922935257256151778042838037574552",
"54192453191850719379707703564964518831",
"280431694015177591697824716047159989018",
"139993279964610683532623488920246456538",
"2387699097212628135533096810422110206",
"246587325069208931881605630277702438595",
"115479908301602173578573016025004657934",
"69297341997945733718460636254882179424"
]
},
"target": {
"file": "arch/x86/coco/sev/shared.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fec416c03d0a64cc21aa04ce4aa14254b017e6a",
"id": "CVE-2025-38560-d0245db5",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
},
"target": {
"function": "get_cpuflags",
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fec416c03d0a64cc21aa04ce4aa14254b017e6a",
"id": "CVE-2025-38560-d68c86fe",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327219364006018098070465645274847206497",
"229751040809682604328453409919448166481",
"177544621247780147588910928594042472261",
"232627221732086331645271678036440746984",
"268918919079975799108773279601896247491",
"7271568004131833688782353667243381530",
"4649599256220588646638928475520318207",
"91489650625646506535871844112172824749",
"10893742337057087994845897300114470891",
"180918017318794876711237892951639068193"
]
},
"target": {
"file": "arch/x86/kernel/sev.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-e2987d4f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232598209466559849660357943223553938505",
"149690585875036078330306635460241972092",
"188885801923205867213134367583336807515",
"189585808096342126924934796378189070094",
"128838392430848103933475761973894331676",
"317708181830295859258993560426695473586",
"287881622879181507892190205842106992370"
]
},
"target": {
"file": "arch/x86/include/asm/sev.h"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"id": "CVE-2025-38560-ed2a6086",
"digest": {
"function_hash": "70023933490112383224902299082082019924",
"length": 302.0
},
"target": {
"function": "pvalidate_4k_page",
"file": "arch/x86/coco/sev/shared.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-eebfd8d2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
},
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"id": "CVE-2025-38560-f90de3e0",
"digest": {
"function_hash": "288328066503986913630476792604508096028",
"length": 106.0
},
"target": {
"function": "pvalidate_pages",
"file": "arch/x86/coco/sev/core.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]