Linux kernel (drivers/pci/endpoint): Endpoint function sub-groups were created asynchronously by a delayed work item

CVSS 5.5CVE-2025-71233Kernel, userspace & hypervisorcurated

Impact

Endpoint function sub-groups were created asynchronously by a delayed work item, so removing the directory before the work ran left the worker dereferencing a freed parent - a NULL/dangling dereference inside a kernel workqueue that panics the machine.

Who can reach it

Configfs-driven and trivially reproducible: a loop of mkdir/rmdir under /sys/kernel/config/pci_ep/functions/<driver>/ crashes the kernel within about twenty iterations. That is host root on a machine with the PCI endpoint framework and configfs mounted - so the realistic exposure is an endpoint device whose function configuration is scripted or exposed to a management agent, not a tenant. Inert on a conventional GPU server with no endpoint controller.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: do not expose /sys/kernel/config/pci_ep to any automation that creates and destroys function directories rapidly, and keep configfs unmounted on endpoint machines whose function set is static.

References

https://git.kernel.org/stable/c/fa9fb38f5fe9c80094c2138354d45cdc8d094d69 https://git.kernel.org/stable/c/5f609b3bffd4207cf9f2c9b41e1978457a5a1ea9 https://nvd.nist.gov/vuln/detail/CVE-2025-71233

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.