CVE-2025-71233
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Avoid creating sub-groups asynchronously
The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes.
The crash can be easily reproduced with the following commands:
Fix this issue by using configfs_add_default_group() API which does not have the deadlock problem as configfs_register_group() and does not require the delayed work handler.
[mani: slightly reworded the description and added stable list]
Detalles técnicos trazas, registros y código del informe original
# cd /sys/kernel/config/pci_ep/functions/pci_epf_test
# for i in {1..20}; do mkdir test && rmdir test; done
BUG: kernel NULL pointer dereference, address: 0000000000000088
...
Call Trace:
configfs_register_group+0x3d/0x190
pci_epf_cfs_work+0x41/0x110
process_one_work+0x18f/0x350
worker_thread+0x25a/0x3a0CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.12%
- Percentil entre todas las CVEs puntuadas: 2
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
- https://git.kernel.org/stable/c/24a253c3aa6d9a2cde46158ce9782e023bfbf32d
- https://git.kernel.org/stable/c/5f609b3bffd4207cf9f2c9b41e1978457a5a1ea9
- https://git.kernel.org/stable/c/73cee890adafa2c219bb865356e08e7f82423fe5
- https://git.kernel.org/stable/c/7c5c7d06bd1f86d2c3ebe62be903a4ba42db4d2c
- https://git.kernel.org/stable/c/8cb905eca73944089a0db01443c7628a9e87012d
- https://git.kernel.org/stable/c/d9af3cf58bb4c8d6dea4166011c780756b1138b5
- https://git.kernel.org/stable/c/fa9fb38f5fe9c80094c2138354d45cdc8d094d69
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-71233",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"lessThan": "fa9fb38f5fe9c80094c2138354d45cdc8d094d69",
"versionType": "git"
},
{
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"lessThan": "5f609b3bffd4207cf9f2c9b41e1978457a5a1ea9",
"versionType": "git"
},
{
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"lessThan": "8cb905eca73944089a0db01443c7628a9e87012d",
"versionType": "git"
},
{
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"lessThan": "d9af3cf58bb4c8d6dea4166011c780756b1138b5",
"versionType": "git"
},
{
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"lessThan": "24a253c3aa6d9a2cde46158ce9782e023bfbf32d",
"versionType": "git"
},
{
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"lessThan": "73cee890adafa2c219bb865356e08e7f82423fe5",
"versionType": "git"
},
{
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"lessThan": "7c5c7d06bd1f86d2c3ebe62be903a4ba42db4d2c",
"versionType": "git"
}
],
"programFiles": [
"drivers/pci/endpoint/pci-ep-cfs.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.201",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.164",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.127",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.72",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.11",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.1",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/pci/endpoint/pci-ep-cfs.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-02-18T16:22:30.080",
"references": [
{
"url": "https://git.kernel.org/stable/c/24a253c3aa6d9a2cde46158ce9782e023bfbf32d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5f609b3bffd4207cf9f2c9b41e1978457a5a1ea9",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/73cee890adafa2c219bb865356e08e7f82423fe5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c5c7d06bd1f86d2c3ebe62be903a4ba42db4d2c",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8cb905eca73944089a0db01443c7628a9e87012d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d9af3cf58bb4c8d6dea4166011c780756b1138b5",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fa9fb38f5fe9c80094c2138354d45cdc8d094d69",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Avoid creating sub-groups asynchronously\n\nThe asynchronous creation of sub-groups by a delayed work could lead to a\nNULL pointer dereference when the driver directory is removed before the\nwork completes.\n\nThe crash can be easily reproduced with the following commands:\n\n # cd /sys/kernel/config/pci_ep/functions/pci_epf_test\n # for i in {1..20}; do mkdir test && rmdir test; done\n\n BUG: kernel NULL pointer dereference, address: 0000000000000088\n ...\n Call Trace:\n configfs_register_group+0x3d/0x190\n pci_epf_cfs_work+0x41/0x110\n process_one_work+0x18f/0x350\n worker_thread+0x25a/0x3a0\n\nFix this issue by using configfs_add_default_group() API which does not\nhave the deadlock problem as configfs_register_group() and does not require\nthe delayed work handler.\n\n[mani: slightly reworded the description and added stable list]"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPCI: endpoint: Evitar la creación asíncrona de subgrupos\n\nLa creación asíncrona de subgrupos por un trabajo retrasado podría llevar a una desreferencia de puntero NULL cuando el directorio del controlador es eliminado antes de que el trabajo se complete.\n\nEl fallo puede ser fácilmente reproducido con los siguientes comandos:\n\n # cd /sys/kernel/config/pci_ep/functions/pci_epf_test\n # for i in {1..20}; do mkdir test && rmdir test; done\n\n BUG: kernel NULL pointer dereference, address: 0000000000000088\n ...\n Call Trace:\n configfs_register_group+0x3d/0x190\n pci_epf_cfs_work+0x41/0x110\n process_one_work+0x18f/0x350\n worker_thread+0x25a/0x3a0\n\nSoluciona este problema usando la API configfs_add_default_group() que no tiene el problema de interbloqueo como configfs_register_group() y no requiere el manejador de trabajo retrasado.\n\n[mani: se ha reformulado ligeramente la descripción y se ha añadido la lista estable]"
}
],
"lastModified": "2026-06-17T10:03:55.263",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F9D9A1F-E24E-4F40-B86B-30FF1377DAFB",
"versionEndExcluding": "5.15.201",
"versionStartIncluding": "5.12"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6892F74B-3F14-4500-9652-24A2ECB04144",
"versionEndExcluding": "6.1.164",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A9F36A3-A685-48A0-84B4-6217052BD058",
"versionEndExcluding": "6.6.127",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1A7E514-FB3C-4B6B-8046-07D5A8F04644",
"versionEndExcluding": "6.12.72",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7099A9EC-3D54-4424-BF01-7224EF88C79C",
"versionEndExcluding": "6.18.11",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E",
"versionEndExcluding": "6.19.1",
"versionStartIncluding": "6.19"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}