LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40034: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()

In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source device that doesn't advertise an AER Capability and therefore dev->aer_info, which contains AER stats and ratelimiting data, is NULL. pci_dev_aer_stats_incr() already checks dev->aer_info for NULL, but aer_ratelimit() did not, leading to NULL pointer dereferences like this one from the URL below: {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 0 {1}[Hardware Error]: event severity: corrected {1}[Hardware Error]: device_id: 0000:00:00.0 {1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x2020 {1}[Hardware Error]: aer_cor_status: 0x00001000, aer_cor_mask: 0x00002000 BUG: kernel NULL pointer dereference, address: 0000000000000264 RIP: 0010:___ratelimit+0xc/0x1b0 pci_print_aer+0x141/0x360 aer_recover_work_func+0xb5/0x130 [8086:2020] is an Intel "Sky Lake-E DMI3 Registers" device that claims to be a Root Port but does not advertise an AER Capability. Add a NULL check in aer_ratelimit() to avoid the NULL pointer dereference. Note that this also prevents ratelimiting these events from GHES. [bhelgaas: add crash details to commit log]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A Linux kernel crash can occur when firmware reports a PCI error for hardware that lacks expected AER data. The kernel tries to rate-limit the event and can dereference a NULL pointer. The known impact is availability loss, not data theft, based on the provided sources.

Executive priority

Treat as a reliability and uptime issue. Prioritize patching on servers where kernel crashes would disrupt critical services, but current evidence does not support emergency internet-wide exploitation.

Technical view

The flaw is in PCI/AER aer_ratelimit(). GHES/APEI firmware error reporting can identify a PCI device without an AER Capability, leaving dev->aer_info NULL. pci_dev_aer_stats_incr() handled NULL, but aer_ratelimit() did not. Stable fixes add a NULL check.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions where platform firmware reports PCI/AER-style hardware errors through mechanisms such as ACPI APEI GHES, especially for devices without AER Capability.

Exploitation context

The source bundle does not show KEV listing, active exploitation, public exploit code, or remote attack evidence. The documented trigger is firmware-supplied hardware error information causing a kernel NULL pointer dereference during AER handling.

Researcher notes

Evidence supports a local kernel availability bug triggered by hardware error reporting paths. The bundle names Intel Sky Lake-E DMI3 Registers as an observed device example, not a complete affected hardware list. Impact scoring and CWE data are absent.

Mitigation direction

  • Apply Linux kernel or distribution updates containing the referenced stable fixes.
  • Prioritize affected Linux hosts that rely on ACPI APEI GHES hardware error reporting.
  • Track vendor advisories for exact package versions and backports.
  • Do not assume generic configuration changes replace the kernel fix.

Validation and detection

  • Inventory Linux kernel versions against vendor advisories for CVE-2025-40034.
  • Review kernel logs for APEI GHES hardware error reports and PCI/AER crash traces.
  • Confirm the fix includes a NULL check in aer_ratelimit().
  • Verify updated kernels boot and hardware error logging remains operational.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40034 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa57f2bfb4a5863f83087867c0e671f2418212d23, a57f2bfb4a5863f83087867c0e671f2418212d23unaffected
LinuxLinux6.16, 0, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.