CVE-2025-22092

PCI: Fix NULL dereference in SR-IOV VF creation error path

published April 16, 2025

CVSS
—
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix NULL dereference in SR-IOV VF creation error path

Clean up when virtfn setup fails to prevent NULL pointer dereference

during device removal. The kernel oops below occurred due to incorrect

error handling flow when pci_setup_device() fails.

Add pci_iov_scan_device(), which handles virtfn allocation and setup and

cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need

to call pci_stop_and_remove_bus_device(). This prevents accessing

partially initialized virtfn devices during removal.

BUG: kernel NULL pointer dereference, address: 00000000000000d0

RIP: 0010:device_del+0x3d/0x3d0

Call Trace:

pci_remove_bus_device+0x7c/0x100

pci_iov_add_virtfn+0xfa/0x200

sriov_enable+0x208/0x420

mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]

sriov_numvfs_store+0xae/0x1a0

[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00199 · 9.2th percentile
Published
2025-04-16T14:12Z
EPSS history
Timeline
  • 16 APR 14:12Z
    PCI: Fix NULL dereference in SR-IOV VF creation error path
    cvelistv5