Linux kernel (drivers/pci/endpoint/functions): When BAR allocation fails, the endpoint test function frees the backing

CVSS 5.9CVE-2025-38069Kernel, userspace & hypervisorcurated

Impact

When BAR allocation fails, the endpoint test function frees the backing memory but leaves the stale pointer in place, so the next allocation round frees the same buffer again. A double free in the host kernel oopses the node, and double frees are a classic route to heap control rather than a mere crash.

Who can reach it

Endpoint mode required, and the trigger comes from the OTHER side of the link: the connected host rebooting deasserts PERST#, which restarts BAR allocation on the endpoint. If inbound windows are exhausted so pci_epc_set_bar() fails, each host reboot re-runs the failing path and hits the double free. That makes it remotely drivable, pre-authentication, by whoever controls the host the endpoint is plugged into - a real consideration for a card handed to a tenant chassis, and inert on a conventional GPU server.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: configure endpoint functions with no more BARs than the controller has free inbound windows, so the allocation failure that starts this sequence never occurs.

References

https://git.kernel.org/stable/c/fe2329eff5bee461ebcafadb6ca1df0cbf5945fd https://git.kernel.org/stable/c/8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee https://nvd.nist.gov/vuln/detail/CVE-2025-38069

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.