Linux Kernel PCI Component Vulnerability Affecting Certain Devices

CVE-2025-39784

What is CVE-2025-39784?

In the Linux kernel's PCI subsystem, a flaw exists related to the link speed calculation during retraining failures. The function pcie_failed_link_retrain() erroneously attempts to revert to a previous link speed based on values from the Link Control 2 register, neglecting to mask out non-speed-related bits. This oversight can lead to the system incorrectly identifying the speed as 'PCI_SPEED_UNKNOWN'. As a result, the system logs warnings indicating the device is broken and retraining fails. To mitigate this, the non-speed bits in functions PCIE_LNKCTL2_TLS2SPEED() and PCIE_LNKCAP_SLS2SPEED() have been adjusted to ensure accurate speed reporting.

References