In the Linux kernel, the following vulnerability has been resolved:
x86/sev: Evict cache lines during SNP memory validation
An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation.
CPUID bit Fn8000001FEBX[31] defines the COHERENCYSFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed.
Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCYSFWNO bit is not set, indicating the SNP guest is vulnerable.
[
{
"signature_version": "v1",
"id": "CVE-2025-38560-1032cfa1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/boot/startup/sev-shared.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"140723014718515970609396044434420815682",
"14523072751488706541357951368216153234",
"221191538104339766805141375363132129506",
"226447587976092394573927084667896621649"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-17d020ef",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c",
"function": "get_cpuflags"
},
"signature_type": "Function",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-1d361adb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/sev.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"329703760950818851871993235597502738189",
"170662081391379612820525371145949370850",
"213987905076852183389863737265172240689",
"123382838111551937558817030708848624618",
"172424528408402532081511904530364274143",
"160870720958685109475103294966831146214",
"103804099679760216356717198678504359664",
"271515619693505977926653088740957200429",
"139915491623527434119172376247612714911",
"128550022671887387603885818222196941899"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-2b12d110",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233902922935257256151778042838037574552",
"54192453191850719379707703564964518831",
"280431694015177591697824716047159989018",
"139993279964610683532623488920246456538",
"2387699097212628135533096810422110206",
"246587325069208931881605630277702438595",
"115479908301602173578573016025004657934",
"69297341997945733718460636254882179424"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-2e238b9d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-302f18da",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/core.c",
"function": "pvalidate_pages"
},
"signature_type": "Function",
"digest": {
"function_hash": "288328066503986913630476792604508096028",
"length": 106.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-31c3a2be",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c",
"function": "get_cpuflags"
},
"signature_type": "Function",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-33d1cb37",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-34b3d077",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a762a4c8d9e768b538b3cc60615361a8cf377de8",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"270172561786410787974324281980039040681",
"139126940183969138903067580270677011061",
"40404752158047755676411923744547965694",
"100595675648875436320419001049689734169"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-37d40b74",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a762a4c8d9e768b538b3cc60615361a8cf377de8",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c",
"function": "get_cpuflags"
},
"signature_type": "Function",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-3f504f1c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"270172561786410787974324281980039040681",
"139126940183969138903067580270677011061",
"40404752158047755676411923744547965694",
"100595675648875436320419001049689734169"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-41d9666a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/core.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233902922935257256151778042838037574552",
"54192453191850719379707703564964518831",
"280431694015177591697824716047159989018",
"139993279964610683532623488920246456538",
"2387699097212628135533096810422110206",
"246587325069208931881605630277702438595",
"115479908301602173578573016025004657934",
"69297341997945733718460636254882179424"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-42573bb8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a762a4c8d9e768b538b3cc60615361a8cf377de8",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/shared.c",
"function": "pvalidate_pages"
},
"signature_type": "Function",
"digest": {
"function_hash": "288328066503986913630476792604508096028",
"length": 106.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-45676484",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/shared.c",
"function": "pvalidate_pages"
},
"signature_type": "Function",
"digest": {
"function_hash": "288328066503986913630476792604508096028",
"length": 106.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-4584cbaf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a762a4c8d9e768b538b3cc60615361a8cf377de8",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-4c50e52d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a762a4c8d9e768b538b3cc60615361a8cf377de8",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/shared.c",
"function": "pvalidate_4k_page"
},
"signature_type": "Function",
"digest": {
"function_hash": "12339510141167169368910825232376766516",
"length": 289.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-4d9a48fc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/boot/compressed/sev.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"99353340359117064703816161989519361386",
"84862729666406753349207588319493489058",
"100695254755424891331737251556299828854",
"279775754994235260925422618058150027065"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-515f5a8e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/sev-shared.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300510767974922250030560852825823691646",
"309970619486026181423573346267212554809",
"119567623046982740609888996015954945926",
"79405946624442530134208035399648022006",
"252308427105193043666189128698630281177",
"58580249375006341746158778917316405672",
"262549941534404800393092390571298440515"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-6407c6d2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"270172561786410787974324281980039040681",
"139126940183969138903067580270677011061",
"40404752158047755676411923744547965694",
"100595675648875436320419001049689734169"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-7b0e1567",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319333414944196741658838000084609720210",
"273777521123997858359649387279554185043",
"279150842259730276560217949362567941654",
"100595675648875436320419001049689734169"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-7cc83eac",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c",
"function": "get_cpuflags"
},
"signature_type": "Function",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-882d5a57",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/boot/startup/sev-shared.c",
"function": "pvalidate_4k_page"
},
"signature_type": "Function",
"digest": {
"function_hash": "32663086915179879701273440917758037044",
"length": 276.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-89dd09ad",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-89e68f71",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/boot/startup/sev-shared.c",
"function": "pvalidate_4k_page"
},
"signature_type": "Function",
"digest": {
"function_hash": "32663086915179879701273440917758037044",
"length": 276.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-8c91441c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/boot/startup/sev-shared.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"140723014718515970609396044434420815682",
"14523072751488706541357951368216153234",
"221191538104339766805141375363132129506",
"226447587976092394573927084667896621649"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-9d8bba45",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/boot/compressed/sev.c",
"function": "__page_state_change"
},
"signature_type": "Function",
"digest": {
"function_hash": "27013470874179396638559525187380476352",
"length": 608.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-9f3ca5eb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b306dfa326f70114312b320d083b21fa9481e1e",
"deprecated": false,
"target": {
"file": "arch/x86/include/asm/sev.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232598209466559849660357943223553938505",
"149690585875036078330306635460241972092",
"188885801923205867213134367583336807515",
"189585808096342126924934796378189070094",
"128838392430848103933475761973894331676",
"317708181830295859258993560426695473586",
"287881622879181507892190205842106992370"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-b69530c9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/cpu/scattered.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113302280571249228799993000574717352351",
"151584611480411124950860580961520804928",
"15494435544886361202746068065562742188",
"100595675648875436320419001049689734169"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-bcfad88b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/sev-shared.c",
"function": "pvalidate_pages"
},
"signature_type": "Function",
"digest": {
"function_hash": "48864456732978534131688056634195077202",
"length": 802.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-ce228dbf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/shared.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"105122229636331257663554586754397953709",
"308338381791112539748151015159464701208",
"294913771912601159530181182700305806728",
"313244894893371976322354755446634537923",
"295776850403428643653744672437525127205",
"154924550083155090256333034377084294645",
"119837980791761331798734799023397649874",
"233902922935257256151778042838037574552",
"54192453191850719379707703564964518831",
"280431694015177591697824716047159989018",
"139993279964610683532623488920246456538",
"2387699097212628135533096810422110206",
"246587325069208931881605630277702438595",
"115479908301602173578573016025004657934",
"69297341997945733718460636254882179424"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-e2987d4f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/include/asm/sev.h"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232598209466559849660357943223553938505",
"149690585875036078330306635460241972092",
"188885801923205867213134367583336807515",
"189585808096342126924934796378189070094",
"128838392430848103933475761973894331676",
"317708181830295859258993560426695473586",
"287881622879181507892190205842106992370"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-e5981b80",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/kernel/sev.c",
"function": "early_set_pages_state"
},
"signature_type": "Function",
"digest": {
"function_hash": "170330595646452765334094568558213244360",
"length": 1207.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-ed2a6086",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aed15fc08f15dbb15822b2a0b653f67e76aa0fdf",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/shared.c",
"function": "pvalidate_4k_page"
},
"signature_type": "Function",
"digest": {
"function_hash": "70023933490112383224902299082082019924",
"length": 302.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-eebfd8d2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"79390009285453357274104683033335897473",
"93009182287586630502607543771725285237",
"107555219428556357939620138253481018122"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-f315565a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fb873971e23c35c53823c62809a474a92bc3022",
"deprecated": false,
"target": {
"file": "arch/x86/boot/cpuflags.c",
"function": "get_cpuflags"
},
"signature_type": "Function",
"digest": {
"function_hash": "60846954837983174203123106459365830739",
"length": 910.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-f65dbc61",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a762a4c8d9e768b538b3cc60615361a8cf377de8",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/shared.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"12273382489018642207594052189807495802",
"215476847738857467501749355295353783816",
"177450414084793515406068889167793514446",
"140723014718515970609396044434420815682",
"14523072751488706541357951368216153234",
"60208031008899595730332949138133747951",
"119837980791761331798734799023397649874",
"233902922935257256151778042838037574552",
"54192453191850719379707703564964518831",
"280431694015177591697824716047159989018",
"139993279964610683532623488920246456538",
"2387699097212628135533096810422110206",
"246587325069208931881605630277702438595",
"115479908301602173578573016025004657934",
"69297341997945733718460636254882179424"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38560-f90de3e0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f92af52e6dbd8d066d77beba451e0230482dc45b",
"deprecated": false,
"target": {
"file": "arch/x86/coco/sev/core.c",
"function": "pvalidate_pages"
},
"signature_type": "Function",
"digest": {
"function_hash": "288328066503986913630476792604508096028",
"length": 106.0
}
}
]