CVE-2025-22092

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix NULL dereference in SR-IOV VF creation error path

Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to incorrect error handling flow when pci_setup_device() fails.

Add pci_iov_scan_device(), which handles virtfn allocation and setup and cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need to call pci_stop_and_remove_bus_device(). This prevents accessing partially initialized virtfn devices during removal.

[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]

Detalles técnicos trazas, registros y código del informe original

  BUG: kernel NULL pointer dereference, address: 00000000000000d0
  RIP: 0010:device_del+0x3d/0x3d0
  Call Trace:
   pci_remove_bus_device+0x7c/0x100
   pci_iov_add_virtfn+0xfa/0x200
   sriov_enable+0x208/0x420
   mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]
   sriov_numvfs_store+0xae/0x1a0

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 5.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.20%
Percentil entre todas las CVEs puntuadas: 9
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-476

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-22092",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "lessThan": "ef421b4d206f0d3681804b8f94f06a8458a53aaf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "lessThan": "c67a233834b778b8c78f8b62c072ccf87a9eb6d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "lessThan": "04d50d953ab46d96b0b32d5ad955fceaa28622db",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver",
              "lessThanOrEqual": "6.13.*"
            },
            {
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.14.*"
            },
            {
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-04-16T15:16:03.403",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/04d50d953ab46d96b0b32d5ad955fceaa28622db",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c67a233834b778b8c78f8b62c072ccf87a9eb6d0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ef421b4d206f0d3681804b8f94f06a8458a53aaf",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix NULL dereference in SR-IOV VF creation error path\n\nClean up when virtfn setup fails to prevent NULL pointer dereference\nduring device removal. The kernel oops below occurred due to incorrect\nerror handling flow when pci_setup_device() fails.\n\nAdd pci_iov_scan_device(), which handles virtfn allocation and setup and\ncleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need\nto call pci_stop_and_remove_bus_device().  This prevents accessing\npartially initialized virtfn devices during removal.\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000d0\n  RIP: 0010:device_del+0x3d/0x3d0\n  Call Trace:\n   pci_remove_bus_device+0x7c/0x100\n   pci_iov_add_virtfn+0xfa/0x200\n   sriov_enable+0x208/0x420\n   mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]\n   sriov_numvfs_store+0xae/0x1a0\n\n[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI: Se corrige la desreferencia de NULL en la ruta de error de creación de VF de SR-IOV. Se limpia cuando falla la configuración de virtfn para evitar la desreferencia de punteros NULL durante la eliminación del dispositivo. El error del kernel que se muestra a continuación se produjo debido a un flujo de gestión de errores incorrecto cuando falla pci_setup_device(). Se ha añadido pci_iov_scan_device(), que gestiona la asignación y configuración de virtfn y realiza la limpieza si falla pci_setup_device(), de modo que pci_iov_add_virtfn() no necesite llamar a pci_stop_and_remove_bus_device(). Esto impide el acceso a dispositivos virtfn parcialmente inicializados durante la eliminación. ERROR: desreferencia de puntero NULL del kernel, dirección: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Rastreo de llamadas: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 [bhelgaas: registro de confirmaciones, devuelve ERR_PTR(-ENOMEM) directamente]"
    }
  ],
  "lastModified": "2026-06-17T08:45:07.597",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7E864B0-8C00-4679-BA55-659B4C9C3AD3",
              "versionEndExcluding": "6.13.11",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FADAE5D8-4808-442C-B218-77B2CE8780A0",
              "versionEndExcluding": "6.14.2",
              "versionStartIncluding": "6.14"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}