Security readout for executives and security teams
Plain-English summary
A local user with limited privileges may trigger a Linux kernel memory-safety flaw in the PCI endpoint test driver. Successful exploitation could compromise confidentiality, integrity, and availability. Exposure depends on the vulnerable driver and affected kernel code being present and accessible.
Executive priority
Treat as a high-priority local privilege and system-compromise risk on exposed test or development systems. Rapidly establish whether the PCI endpoint test driver is deployed, then apply verified vendor updates. Broad emergency action is not supported without evidence that the affected interface is present or actively exploited.
Technical view
Adding NO_BAR as -1 made the PCI BAR enumeration signed. pci_endpoint_test_ioctl() can accept a negative BAR number and pass it to pci_endpoint_test_bar(), causing an array underflow. The supplied CVSS 3.1 score is 7.8, reflecting local access, low complexity, low privileges, no user interaction, and potentially severe system impact.
Likely exposure
Likely limited to Linux systems containing the affected pci_endpoint_test driver code and allowing a low-privileged local user to reach its ioctl interface. The bundle names Linux 6.17, 6.17.3, and 6.18, but its version data is ambiguous and does not establish a precise affected range.
Exploitation context
The supplied record does not claim public exploitation, and CVE-2025-40117 is not identified as CISA KEV. The CVSS vector describes a local, low-privilege attack with low complexity. No remote attack path is supported by the supplied evidence.
Researcher notes
The core defect is a negative index reaching PCI BAR array handling after the enum became signed. Two stable-kernel fix commits are referenced. The supplied version metadata contains unclear entries, including “0” and a commit listed under an unaffected default, so exact branch boundaries should be confirmed from vendor advisories or kernel history.
Mitigation direction
- Apply a vendor kernel update incorporating one of the referenced stable fixes.
- Check distribution or Linux vendor guidance for precise affected and corrected package versions.
- Prioritize systems where untrusted local users can access the PCI endpoint test interface.
- Limit local access to affected systems until a corrected kernel is running.
Validation and detection
- Record the running kernel and installed kernel package versions.
- Determine whether the pci_endpoint_test driver is present and operational.
- Map vendor kernel source or changelog data to the two referenced fix commits.
- After updating and rebooting, confirm the corrected kernel is running.
- Review vendor advisories because the supplied affected-version data is ambiguous.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40117 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6df3687922570f753574c40b35e83b26b32292d0CVE reference, Linux
- https://git.kernel.org/stable/c/1ad82f9db13d85667366044acdfb02009d576c5aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.