LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40076: PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()

In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because the object of type struct irq_domain_info passed to: msi_create_parent_irq_domain() -> irq_domain_instantiate()() -> __irq_domain_instantiate() has no reference to the parent IRQ domain. Using msi->domain->parent as an argument for generic_handle_domain_irq() leads to below error: "Unable to handle kernel NULL pointer dereference at virtual address" This error was identified while switching the upcoming RZ/G3S PCIe host controller driver to msi_create_parent_irq_domain() (which was using a similar pattern to handle MSIs (see link section)), but it was not tested on hardware using the pcie-rcar-host controller driver due to lack of hardware. [mani: reworded subject and description]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash the kernel when a PCIe MSI interrupt is handled through the rcar-host driver with a missing parent IRQ domain. The public record does not show active exploitation or a broad remote attack path.

Executive priority

Treat this as targeted operational stability risk, not confirmed widespread exploitation. Prioritize affected embedded or hardware-specific Linux deployments, especially where kernel crashes would affect availability.

Technical view

After commit dd26c1a23fd5, rcar-host may pass msi->domain->parent to generic_handle_domain_irq() when that parent domain is NULL. The described failure is a kernel NULL pointer dereference. The fix passes the proper IRQ domain.

Likely exposure

Exposure appears limited to Linux kernels containing the affected rcar-host PCIe host controller logic, especially systems using that driver path. The source lists affected Linux 6.17-related versions and the triggering commit, but provides no CPEs.

Exploitation context

CISA KEV status is false in the source bundle. The evidence describes a crash found during driver work, not real-world exploitation. The record says it was not tested on pcie-rcar-host hardware due to lack of hardware.

Researcher notes

The vulnerability is a kernel driver bug in IRQ-domain handling. Public evidence supports crash impact from a NULL parent domain, but not privilege escalation, remote reachability, or active exploitation.

Mitigation direction

  • Apply Linux stable kernel updates containing the referenced fixes.
  • Check distribution kernel advisories for packaged backports.
  • Prioritize systems using the rcar-host PCIe host controller driver.
  • If updates are unavailable, follow vendor kernel guidance.

Validation and detection

  • Inventory Linux kernel versions against the CVE record.
  • Check whether the rcar-host PCIe driver is present or used.
  • Confirm the referenced stable commits are included or backported.
  • Review kernel logs for NULL pointer dereference traces in PCI/MSI handling.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40076 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdd26c1a23fd5a607c50738ea0dcb6cdbb8185cfe, dd26c1a23fd5a607c50738ea0dcb6cdbb8185cfeunaffected
LinuxLinux6.17, 0, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.