Linux Kernel Vulnerability in PCI Endpoint Driver Management

CVE-2025-39783

What is CVE-2025-39783?

A vulnerability in the Linux kernel was identified in the PCI endpoint driver management, where an improper handler for the configfs group list head could trigger a use-after-free condition. The issue arises from executing a list_del() on a field that should not be modified in that manner, especially when tearing down an endpoint function driver that has a configfs attribute group. This oversight can lead to potential system instability and security risks, as demonstrated by the KASAN warning during the removal process. A correction has been made to prevent this error by removing the incorrect list_del() call within the pci_epf_remove_cfs() function.

References