Linux kernel (drivers/pci/endpoint/functions): The endpoint test function releases DMA channels it may never have

CVSS 5.5CVE-2025-40032Kernel, userspace & hypervisorcurated

Impact

The endpoint test function releases DMA channels it may never have acquired, dereferencing NULL inside the DMA core. The dereference happens in an interrupt thread on the endpoint machine and panics it, so the card or DPU drops off the link entirely.

Who can reach it

Endpoint mode required, and the trigger comes from across the link: the upstream panic runs from tegra_pcie_ep_pex_rst_irq, the interrupt raised when the connected HOST asserts PERST#. Any host reset or reboot therefore reaches this path with no authentication of any kind. Inert on a conventional GPU server, live on hardware running Linux as a PCIe endpoint whose host side is not under your control.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: unbind the pci-epf-test function driver - it is a test function and should not be bound in production endpoint configurations at all.

References

https://git.kernel.org/stable/c/6411f840a9b5c47c00ca8e004733de232553870d https://git.kernel.org/stable/c/0c5ce6b6ccc22d486cc7239ed908cb0ae5363a7b https://nvd.nist.gov/vuln/detail/CVE-2025-40032

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.