Linux kernel (drivers/pci/endpoint): The endpoint function core calls list_del() on a structure that is a list HEAD

Impact

The endpoint function core calls list_del() on a structure that is a list HEAD, not a list entry, so tearing down an endpoint function driver writes two pointers into memory that has already been freed. KASAN reports it as a slab use-after-free write - an attacker-useful primitive, not just a crash, if the freed slab has been reallocated.

Who can reach it

Endpoint mode required. Triggered by unloading an endpoint function driver that registered a configfs attribute group; the upstream KASAN splat came from unloading nvmet_pci_epf, the NVMe-over-PCIe endpoint target. That is host root on the endpoint machine, not a tenant action - but nvmet_pci_epf is exactly the kind of tenant-facing storage target a provider would run on an endpoint device, and its module lifecycle is part of normal service management.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: do not unload endpoint function driver modules on a live system - especially nvmet_pci_epf - and reboot to change endpoint function configuration.

References

Related entries

• Linux kernel (drivers/pci/endpoint): Endpoint function sub-groups were created asynchronously by a delayed work itemCVE-2025-71233 · Linux kernel (drivers/pci/endpoint)Medium
• Linux kernel (drivers/pci/endpoint): Pci_epc_destroy() releases the PCI domain ID using a device object it has alreadyCVE-2024-56561 · Linux kernel (drivers/pci/endpoint)Medium
• Linux kernel (drivers/vfio/cdx): A tenant can call the interrupt-configuration ioctl with the trigger flags before MSICVE-2026-46034 · Linux kernel (drivers/vfio/cdx)Medium
• OpenSSH client X11 forwarding: a local user can pre-bind the X socket and hijack a forwarded sessionCVE-2026-55655 · OpenSSH client X11 forwarding (abstract UNIX X socket pre-binding)Medium
• Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.x: Proof that interrupt remapping is not a completeCVE-2013-3495 · Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.xMedium
• Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devices: A tenant clears theCVE-2015-2150 · Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devicesMedium