Linux kernel (drivers/pci/endpoint/functions): The NTB endpoint function drivers never checked whether their workqueue

CVSS 4.4CVE-2025-71313Kernel, userspace & hypervisorcurated

Impact

The NTB endpoint function drivers never checked whether their workqueue was actually created, so a failed allocation leaves a NULL pointer that is later handed to queue_work() during endpoint controller init - a NULL dereference that panics the machine at link-up time rather than failing the bind cleanly.

Who can reach it

Endpoint mode with the NTB (non-transparent bridge) function driver bound, plus an allocation failure at bind time - so realistically a memory-pressured endpoint device, not a targeted attack. The dereference itself lands in epf_ntb_epc_init(), which runs when the connected host brings the link up. Inert on a conventional GPU server; relevant to NTB-based host-to-host interconnect hardware.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim: do not bind the NTB endpoint function drivers on memory-constrained endpoint devices, and keep headroom so the allocation succeeds.

References

https://git.kernel.org/stable/c/314eab6740bcda504ef978be599f805de05ce6de https://git.kernel.org/stable/c/03f336a869b3a3f119d3ae52ac9723739c7fb7b6 https://nvd.nist.gov/vuln/detail/CVE-2025-71313

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.