Linux kernel (drivers/pci/controller): The Intel VMD driver guarded config-space access with a lock type that becomes a

CVSS 4.7CVE-2025-23161Kernel, userspace & hypervisorcurated

Impact

The Intel VMD driver guarded config-space access with a lock type that becomes a sleeping lock under PREEMPT_RT, while the PCI core calls into it with interrupts disabled. Reading config space then sleeps in atomic context - a BUG splat and a wedged CPU on the shared node, reached from an ordinary sysfs read rather than anything privileged.

Who can reach it

The reported call chain starts in sysfs: pci_read_config -> pci_user_read_config_byte -> vmd_pci_read, i.e. a read of /sys/bus/pci/devices/<dev>/config for a device behind Intel VMD. Any local process that can open that file reaches it, including a tenant container with the default sysfs mount. Conditional on two things and inert without both: a PREEMPT_RT kernel, and Intel VMD enabled in BIOS (common on Intel server platforms fronting NVMe).

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: on PREEMPT_RT nodes, either disable VMD in BIOS or mask sysfs config-space files from tenant containers; on non-RT kernels no action is needed.

References

https://git.kernel.org/stable/c/c250262d6485ca333e9821f85b07eb383ec546b1 https://git.kernel.org/stable/c/c2968c812339593ac6e2bdd5cc3adabe3f05fa53 https://nvd.nist.gov/vuln/detail/CVE-2025-23161

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.