PCI/MSI Vulnerability in Linux Kernel Affecting Multiple Architectures

CVE-2025-37889

Summary

A vulnerability in the Linux kernel's handling of the PCI/MSI framework could lead to a NULL pointer dereference due to improper flag management. Specifically, the conversion of the XEN specific global variable pci_msi_ignore_mask into an MSI domain flag did not account for legacy architectures lacking an interrupt domain and the potential absence of domain info in parent MSI domains. This oversight can cause system instability and crashes in affected environments. The issue has been addressed by implementing the pci_msi_domain_supports() helper, which ensures correct handling across all scenarios.

References