CVE-2025-54566: QEMU Privilege Escalation Vulnerability

CVE-2025-54566 Overview

CVE-2025-54566 is a migration state inconsistency vulnerability in QEMU's PCIe Single Root I/O Virtualization (SR-IOV) implementation. The flaw resides in hw/pci/pcie_sriov.c and affects all QEMU versions through 10.0.3. The issue is related to CVE-2024-26327, indicating a recurring weakness in how SR-IOV state is tracked across virtual machine migration operations. The vulnerability is categorized as external control of critical state data [CWE-642] and can be triggered from the adjacent network. Successful exploitation may compromise guest integrity and availability without exposing confidential data.

Critical Impact
An adjacent-network attacker can trigger inconsistent SR-IOV migration state in QEMU, leading to limited integrity and availability impact on virtualized workloads.

Affected Products

QEMU versions through 10.0.3
QEMU builds with PCIe SR-IOV emulation enabled (hw/pci/pcie_sriov.c)
Virtualization platforms and cloud hypervisors shipping affected QEMU releases

Discovery Timeline

2025-07-25 - CVE-2025-54566 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54566

Vulnerability Analysis

QEMU implements PCIe SR-IOV to allow guests to interact with virtual functions exposed by emulated or passed-through PCIe devices. The file hw/pci/pcie_sriov.c manages the state of SR-IOV capabilities, including the number of virtual functions (NumVFs), VF offset, and VF enablement. During live migration, this state must be serialized and restored consistently on both source and destination hosts.

The vulnerability stems from improper handling of write masks and migration state for SR-IOV configuration registers. A guest can place the device into a configuration whose state is not fully preserved or validated across migration. This creates divergence between the migrated register view and the internal device model on the destination. The flaw is a recurrence pattern of CVE-2024-26327, where similar SR-IOV state tracking issues were previously addressed but not fully eliminated.

Root Cause

The root cause is external control of system or configuration state [CWE-642]. SR-IOV capability registers in QEMU accept guest-controlled values without enforcing consistent migration semantics. When the guest manipulates these registers prior to migration, the destination QEMU instance reconstructs device state from values that do not match the device model's assumptions. Technical details are documented in the QEMU Development Mailing List Post.

Attack Vector

Exploitation requires adjacent-network access with the ability to influence a guest or migration workflow. An attacker who controls a guest can program SR-IOV capability registers into a state that triggers inconsistency during migration. No authentication to the host is required, and the guest user does not need elevated privileges inside the VM to reach the vulnerable code path. The resulting inconsistency may cause device malfunction, migration failure, or limited guest tampering.

No verified public proof-of-concept code is available. Refer to the QEMU
mailing list discussion linked above for the technical patch analysis
and register-write-mask reasoning behind the fix.

Detection Methods for CVE-2025-54566

Indicators of Compromise

Unexpected QEMU process termination or device model errors following live migration of guests using SR-IOV virtual functions.
Migration failures logged by libvirt or orchestration layers referencing PCIe capability or VF state mismatches.
Guest-reported PCI configuration anomalies on virtual functions after migration completes.

Detection Strategies

Inventory hypervisor hosts running QEMU 10.0.3 or earlier and flag those exposing SR-IOV devices to untrusted tenants.
Correlate hypervisor logs, libvirt events, and migration audit trails to identify guests that repeatedly induce SR-IOV register changes near migration windows.
Review guest workloads for drivers that abnormally toggle NumVFs or VF enable bits outside normal provisioning flows.

Monitoring Recommendations

Enable verbose QEMU and libvirt logging on hosts performing SR-IOV migrations to capture register state transitions.
Monitor VM migration success rates and alert on anomalous spikes in migration-abort events tied to PCI capability processing.
Feed hypervisor and orchestration logs into a centralized analytics platform to correlate guest-triggered reconfiguration with host-side errors.

How to Mitigate CVE-2025-54566

Immediate Actions Required

Upgrade QEMU to a version later than 10.0.3 that incorporates the SR-IOV write-mask and migration state fix referenced on the QEMU development mailing list.
Restrict live migration of guests using SR-IOV devices until the hypervisor fleet is patched.
Limit tenant ability to attach or reconfigure SR-IOV virtual functions on multi-tenant hypervisors.

Patch Information

The upstream fix is tracked through the QEMU development mailing list patch series discussed in the QEMU Development Mailing List Post. Distribution maintainers for Red Hat, Debian, Ubuntu, and SUSE typically backport QEMU security fixes. Verify the installed package version against vendor advisories before considering a host remediated.

Workarounds

Disable SR-IOV virtual function exposure to guests on hypervisors that cannot be patched immediately.
Avoid live migration for VMs attached to SR-IOV devices; use cold migration or shutdown-restart workflows instead.
Isolate migration traffic on a dedicated management network segment that is not reachable by guest workloads.

bash

# Verify installed QEMU version on affected hosts
qemu-system-x86_64 --version

# List running guests using SR-IOV virtual functions (libvirt)
virsh list --all
for dom in $(virsh list --name); do
  virsh dumpxml "$dom" | grep -E 'hostdev|sriov|virtualport'
done