CVE-2025-22092 (GCVE-0-2025-22092)
Vulnerability from cvelistv5
Published
2025-04-16 14:12
Modified
2025-05-26 05:18
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to incorrect error handling flow when pci_setup_device() fails. Add pci_iov_scan_device(), which handles virtfn allocation and setup and cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need to call pci_stop_and_remove_bus_device(). This prevents accessing partially initialized virtfn devices during removal. BUG: kernel NULL pointer dereference, address: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Call Trace: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 [bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]
References
Impacted products
Vendor Product Version
Linux Linux Version: e3f30d563a388220a7c4e3b9a7b52ac0b0324b26
Version: e3f30d563a388220a7c4e3b9a7b52ac0b0324b26
Version: e3f30d563a388220a7c4e3b9a7b52ac0b0324b26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef421b4d206f0d3681804b8f94f06a8458a53aaf",
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "versionType": "git"
            },
            {
              "lessThan": "c67a233834b778b8c78f8b62c072ccf87a9eb6d0",
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "versionType": "git"
            },
            {
              "lessThan": "04d50d953ab46d96b0b32d5ad955fceaa28622db",
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix NULL dereference in SR-IOV VF creation error path\n\nClean up when virtfn setup fails to prevent NULL pointer dereference\nduring device removal. The kernel oops below occurred due to incorrect\nerror handling flow when pci_setup_device() fails.\n\nAdd pci_iov_scan_device(), which handles virtfn allocation and setup and\ncleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn\u0027t need\nto call pci_stop_and_remove_bus_device().  This prevents accessing\npartially initialized virtfn devices during removal.\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000d0\n  RIP: 0010:device_del+0x3d/0x3d0\n  Call Trace:\n   pci_remove_bus_device+0x7c/0x100\n   pci_iov_add_virtfn+0xfa/0x200\n   sriov_enable+0x208/0x420\n   mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]\n   sriov_numvfs_store+0xae/0x1a0\n\n[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:18:17.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef421b4d206f0d3681804b8f94f06a8458a53aaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/c67a233834b778b8c78f8b62c072ccf87a9eb6d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/04d50d953ab46d96b0b32d5ad955fceaa28622db"
        }
      ],
      "title": "PCI: Fix NULL dereference in SR-IOV VF creation error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22092",
    "datePublished": "2025-04-16T14:12:43.879Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2025-05-26T05:18:17.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22092\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:03.403\",\"lastModified\":\"2025-04-17T20:22:16.240\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nPCI: Fix NULL dereference in SR-IOV VF creation error path\\n\\nClean up when virtfn setup fails to prevent NULL pointer dereference\\nduring device removal. The kernel oops below occurred due to incorrect\\nerror handling flow when pci_setup_device() fails.\\n\\nAdd pci_iov_scan_device(), which handles virtfn allocation and setup and\\ncleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn\u0027t need\\nto call pci_stop_and_remove_bus_device().  This prevents accessing\\npartially initialized virtfn devices during removal.\\n\\n  BUG: kernel NULL pointer dereference, address: 00000000000000d0\\n  RIP: 0010:device_del+0x3d/0x3d0\\n  Call Trace:\\n   pci_remove_bus_device+0x7c/0x100\\n   pci_iov_add_virtfn+0xfa/0x200\\n   sriov_enable+0x208/0x420\\n   mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]\\n   sriov_numvfs_store+0xae/0x1a0\\n\\n[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI: Se corrige la desreferencia de NULL en la ruta de error de creaci\u00f3n de VF de SR-IOV. Se limpia cuando falla la configuraci\u00f3n de virtfn para evitar la desreferencia de punteros NULL durante la eliminaci\u00f3n del dispositivo. El error del kernel que se muestra a continuaci\u00f3n se produjo debido a un flujo de gesti\u00f3n de errores incorrecto cuando falla pci_setup_device(). Se ha a\u00f1adido pci_iov_scan_device(), que gestiona la asignaci\u00f3n y configuraci\u00f3n de virtfn y realiza la limpieza si falla pci_setup_device(), de modo que pci_iov_add_virtfn() no necesite llamar a pci_stop_and_remove_bus_device(). Esto impide el acceso a dispositivos virtfn parcialmente inicializados durante la eliminaci\u00f3n. ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Rastreo de llamadas: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 [bhelgaas: registro de confirmaciones, devuelve ERR_PTR(-ENOMEM) directamente]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04d50d953ab46d96b0b32d5ad955fceaa28622db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c67a233834b778b8c78f8b62c072ccf87a9eb6d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ef421b4d206f0d3681804b8f94f06a8458a53aaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.