Linux kernel (drivers/pci/pcie): The AER subsystem allocates its per-device error-tracking structure without checking

CVSS 5.5CVE-2025-68309Kernel, userspace & hypervisorcurated

Impact

The AER subsystem allocates its per-device error-tracking structure without checking for failure, then dereferences it unconditionally. If that allocation fails, every subsequent AER access is a NULL dereference and the node panics - so a burst of PCIe errors arriving while the machine is under memory pressure turns into a full node outage for every tenant.

Who can reach it

Precondition is an allocation failure, which is the honest limiter here - but both halves are things a tenant supplies on a busy GPU node. Memory pressure is the steady state on a node packed with tenants, and the error events are generated by the devices themselves: a tenant with a passthrough GPU, NIC or NVMe behind /dev/vfio/* can drive its own device into producing correctable and uncorrectable PCIe errors at will, which is what makes the AER path run in the first place. No host credentials required for the error-generating half.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: keep real headroom on nodes so the allocation does not fail, and alert on AER error rates per device so a tenant hammering its passthrough device into an error storm is visible before it matters.

References

https://git.kernel.org/stable/c/6618243bcc3f60825f761a41ed65fef9fe97eb25 https://git.kernel.org/stable/c/0a27bdb14b028fed30a10cec2f945c38cb5ca4fa https://nvd.nist.gov/vuln/detail/CVE-2025-68309

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.