CVE-2025-22092 (GCVE-0-2025-22092)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-05-11 21:12
VLAI
Title
PCI: Fix NULL dereference in SR-IOV VF creation error path
Summary
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to incorrect error handling flow when pci_setup_device() fails. Add pci_iov_scan_device(), which handles virtfn allocation and setup and cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need to call pci_stop_and_remove_bus_device(). This prevents accessing partially initialized virtfn devices during removal. BUG: kernel NULL pointer dereference, address: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Call Trace: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 [bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e3f30d563a388220a7c4e3b9a7b52ac0b0324b26 , < ef421b4d206f0d3681804b8f94f06a8458a53aaf (git)
Affected: e3f30d563a388220a7c4e3b9a7b52ac0b0324b26 , < c67a233834b778b8c78f8b62c072ccf87a9eb6d0 (git)
Affected: e3f30d563a388220a7c4e3b9a7b52ac0b0324b26 , < 04d50d953ab46d96b0b32d5ad955fceaa28622db (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.13.11 , ≤ 6.13.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef421b4d206f0d3681804b8f94f06a8458a53aaf",
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "versionType": "git"
            },
            {
              "lessThan": "c67a233834b778b8c78f8b62c072ccf87a9eb6d0",
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "versionType": "git"
            },
            {
              "lessThan": "04d50d953ab46d96b0b32d5ad955fceaa28622db",
              "status": "affected",
              "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pci/iov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix NULL dereference in SR-IOV VF creation error path\n\nClean up when virtfn setup fails to prevent NULL pointer dereference\nduring device removal. The kernel oops below occurred due to incorrect\nerror handling flow when pci_setup_device() fails.\n\nAdd pci_iov_scan_device(), which handles virtfn allocation and setup and\ncleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn\u0027t need\nto call pci_stop_and_remove_bus_device().  This prevents accessing\npartially initialized virtfn devices during removal.\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000d0\n  RIP: 0010:device_del+0x3d/0x3d0\n  Call Trace:\n   pci_remove_bus_device+0x7c/0x100\n   pci_iov_add_virtfn+0xfa/0x200\n   sriov_enable+0x208/0x420\n   mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]\n   sriov_numvfs_store+0xae/0x1a0\n\n[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:12:43.548Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef421b4d206f0d3681804b8f94f06a8458a53aaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/c67a233834b778b8c78f8b62c072ccf87a9eb6d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/04d50d953ab46d96b0b32d5ad955fceaa28622db"
        }
      ],
      "title": "PCI: Fix NULL dereference in SR-IOV VF creation error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22092",
    "datePublished": "2025-04-16T14:12:43.879Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2026-05-11T21:12:43.548Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22092",
      "date": "2026-09-28",
      "epss": "0.00199",
      "percentile": "0.08728"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/pci/iov.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ef421b4d206f0d3681804b8f94f06a8458a53aaf",
                    "status": "affected",
                    "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c67a233834b778b8c78f8b62c072ccf87a9eb6d0",
                    "status": "affected",
                    "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "04d50d953ab46d96b0b32d5ad955fceaa28622db",
                    "status": "affected",
                    "version": "e3f30d563a388220a7c4e3b9a7b52ac0b0324b26",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/pci/iov.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E864B0-8C00-4679-BA55-659B4C9C3AD3",
                    "versionEndExcluding": "6.13.11",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FADAE5D8-4808-442C-B218-77B2CE8780A0",
                    "versionEndExcluding": "6.14.2",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix NULL dereference in SR-IOV VF creation error path\n\nClean up when virtfn setup fails to prevent NULL pointer dereference\nduring device removal. The kernel oops below occurred due to incorrect\nerror handling flow when pci_setup_device() fails.\n\nAdd pci_iov_scan_device(), which handles virtfn allocation and setup and\ncleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn\u0027t need\nto call pci_stop_and_remove_bus_device().  This prevents accessing\npartially initialized virtfn devices during removal.\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000d0\n  RIP: 0010:device_del+0x3d/0x3d0\n  Call Trace:\n   pci_remove_bus_device+0x7c/0x100\n   pci_iov_add_virtfn+0xfa/0x200\n   sriov_enable+0x208/0x420\n   mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]\n   sriov_numvfs_store+0xae/0x1a0\n\n[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: PCI: Se corrige la desreferencia de NULL en la ruta de error de creaci\u00f3n de VF de SR-IOV. Se limpia cuando falla la configuraci\u00f3n de virtfn para evitar la desreferencia de punteros NULL durante la eliminaci\u00f3n del dispositivo. El error del kernel que se muestra a continuaci\u00f3n se produjo debido a un flujo de gesti\u00f3n de errores incorrecto cuando falla pci_setup_device(). Se ha a\u00f1adido pci_iov_scan_device(), que gestiona la asignaci\u00f3n y configuraci\u00f3n de virtfn y realiza la limpieza si falla pci_setup_device(), de modo que pci_iov_add_virtfn() no necesite llamar a pci_stop_and_remove_bus_device(). Esto impide el acceso a dispositivos virtfn parcialmente inicializados durante la eliminaci\u00f3n. ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Rastreo de llamadas: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 [bhelgaas: registro de confirmaciones, devuelve ERR_PTR(-ENOMEM) directamente]"
          }
        ],
        "id": "CVE-2025-22092",
        "lastModified": "2026-06-17T08:45:07.597",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-04-16T15:16:03.403",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/04d50d953ab46d96b0b32d5ad955fceaa28622db"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c67a233834b778b8c78f8b62c072ccf87a9eb6d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ef421b4d206f0d3681804b8f94f06a8458a53aaf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T00:45:31+00:00",
      "cve": "CVE-2025-22092",
      "id": "CVE-2025-22092",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_not_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: PCI: Fix NULL dereference in SR-IOV VF creation error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22092.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:04:05Z",
      "cve": "CVE-2025-22092",
      "id": "CVE-2025-22092",
      "initial_release_date": "2025-04-18T23:19:48Z",
      "product_status:known_not_affected": "467",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22092",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22092.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.