CVE-2025-38625 vfio/pds: Fix missing detach_ioas op
Missing detach_ioas operation in the pds_vfio_pci driver causes probe failure and kernel warnings when IOMMUFD is enabled, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38625?
CVE-2025-38625 is a medium-severity denial of service vulnerability in Linux kernel, published on 22 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vfio/pds: Fix missing detach_ioas op
When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, the following WARN_ON() trace is seen and probe fails:
WARNING: CPU: 0 PID: 5040 at drivers/vfio/vfio_main.c:317 __vfio_register_dev+0x130/0x140 [vfio] <...> pds_vfio_pci 0000:08:00.1: probe with driver pds_vfio_pci failed with error -22
This is because the driver's vfio_device_ops.detach_ioas isn't set.
Fix this by using the generic vfio_iommufd_physical_detach_ioas function.
Which versions are affected by CVE-2025-38625?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38625?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38625 being exploited?
There is no known exploitation of CVE-2025-38625 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-66632, BELL-CVE-2025-38625, DEBIAN-CVE-2025-38625, GHSA-xj8c-4hpj-pm7v, ROOT-OS-DEBIAN-13-CVE-2025-38625, ROOT-OS-UBUNTU-2404-CVE-2025-38625 and 1 more.