CVE-2025-54567: QEMU Privilege Escalation Vulnerability

CVE-2025-54567 Overview

CVE-2025-54567 affects QEMU through version 10.0.3. The flaw resides in hw/pci/pcie_sriov.c, which mishandles the Virtual Function (VF) Enable bit write mask in the Single Root I/O Virtualization (SR-IOV) emulation path. The issue is related to the earlier CVE-2024-26327 regression in the same subsystem. An adjacent-network actor with access to the emulated PCIe device can trigger unintended state changes in guest or hypervisor virtualization logic. The weakness maps to CWE-684: Incorrect Provision of Specified Functionality.

Critical Impact
Improper handling of the SR-IOV VF Enable write mask can lead to integrity and availability impact on QEMU-based virtualization hosts running PCIe SR-IOV emulation.

Affected Products

QEMU versions up to and including 10.0.3
QEMU builds enabling PCIe SR-IOV device emulation (hw/pci/pcie_sriov.c)
Downstream Linux distributions and cloud images shipping vulnerable QEMU packages

Discovery Timeline

2025-07-13 - Fix proposal posted to the QEMU development mailing list
2025-07-25 - CVE-2025-54567 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54567

Vulnerability Analysis

QEMU emulates PCI Express SR-IOV capabilities to allow guest operating systems to manage virtual functions on emulated physical functions. The SR-IOV control register contains a VF Enable bit that governs whether virtual functions are exposed to the guest. QEMU applies a write mask to filter which register bits a guest may modify.

In hw/pci/pcie_sriov.c, the write mask handling for the VF Enable bit is incorrect. A guest driver can write to the register in a way that bypasses the intended semantic constraints on VF enable and disable transitions. This mirrors the class of defect previously tracked as CVE-2024-26327, indicating an incomplete fix or regression in the same code path.

The result is guest-controlled manipulation of virtual function state through paths the write mask was expected to block. This can desynchronize QEMU's internal SR-IOV state and the guest's view of PCI configuration space.

Root Cause

The root cause is an incorrect write mask definition and application for the SR-IOV control register in pcie_sriov.c. The mask fails to restrict guest-writable bits per the PCIe SR-IOV specification, allowing writes that the hypervisor should have suppressed or normalized.

Attack Vector

Exploitation requires adjacent-network positioning per the CVSS vector, meaning access to the emulated device from within a guest or a locally attached logical channel. No authentication or user interaction is required. A guest operating system with a driver for the emulated SR-IOV physical function can issue configuration writes that trigger the flaw, producing integrity and availability impact against the virtualization stack.

No public proof-of-concept exploit is currently available. See the QEMU development discussion for technical details on the corrected write mask logic.

Detection Methods for CVE-2025-54567

Indicators of Compromise

Unexpected QEMU process crashes or aborts on hosts running SR-IOV enabled guests
Guest-side kernel log entries showing anomalous PCI configuration writes to the SR-IOV capability region
QEMU log messages related to pcie_sriov state transitions occurring outside expected VM lifecycle events

Detection Strategies

Inventory QEMU builds across virtualization hosts and flag versions at or below 10.0.3 that expose SR-IOV device emulation to guests
Monitor hypervisor logs and libvirtd events for unexpected VF enable and disable transitions on emulated devices
Correlate guest driver activity targeting SR-IOV configuration space with QEMU stability events on the same host

Monitoring Recommendations

Enable QEMU debug logging for PCI configuration writes during triage on suspect hosts
Track package versions of qemu-system-* binaries through configuration management tooling
Alert on repeated guest-initiated writes to PCIe extended capability offsets associated with SR-IOV

How to Mitigate CVE-2025-54567

Immediate Actions Required

Identify all hosts running QEMU 10.0.3 or earlier with SR-IOV device emulation enabled
Apply vendor updates from your Linux distribution as soon as patched QEMU packages are available
Where patching is not immediately possible, disable emulation of SR-IOV capable PCIe devices to untrusted guests

Patch Information

The fix is discussed in the upstream QEMU patch series posted on the qemu-devel mailing list. Refer to the QEMU patch thread on lore.kernel.org for the corrected pcie_sriov.c write mask implementation. Track your distribution's QEMU security advisories for backported builds.

Workarounds

Remove SR-IOV capable emulated devices from guest domain XML configurations until patches are deployed
Restrict guest workloads on unpatched hosts to trusted tenants only
Isolate virtualization hosts running vulnerable QEMU builds from multi-tenant workloads on the adjacent network

bash

# Example: identify installed QEMU version on a Linux host
qemu-system-x86_64 --version

# Example: list domains using SR-IOV hostdev or emulated SR-IOV devices
virsh list --all | awk 'NR>2 {print $2}' | while read dom; do
  [ -n "$dom" ] && virsh dumpxml "$dom" | grep -Ei 'sriov|hostdev' && echo "^-- $dom"
done