LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71233: PCI: endpoint: Avoid creating sub-groups asynchronously

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes. The crash can be easily reproduced with the following commands: # cd /sys/kernel/config/pci_ep/functions/pci_epf_test # for i in {1..20}; do mkdir test && rmdir test; done BUG: kernel NULL pointer dereference, address: 0000000000000088 ... Call Trace: configfs_register_group+0x3d/0x190 pci_epf_cfs_work+0x41/0x110 process_one_work+0x18f/0x350 worker_thread+0x25a/0x3a0 Fix this issue by using configfs_add_default_group() API which does not have the deadlock problem as configfs_register_group() and does not require the delayed work handler. [mani: slightly reworded the description and added stable list]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-71233 is a Linux kernel PCI endpoint configfs bug that can crash the kernel when endpoint function groups are created and removed quickly. The business risk is availability loss on affected systems, not confirmed remote compromise. Public sources do not provide CVSS, CWE, or evidence of active exploitation.

Executive priority

Handle through normal kernel patch governance, with faster action for systems where users or automation can manipulate PCI endpoint configfs. The main concern is service interruption from a kernel crash. There is no source-backed evidence of active exploitation or remote compromise.

Technical view

The bug is a NULL pointer dereference in the Linux PCI endpoint configfs path. Delayed asynchronous subgroup creation can run after the driver directory is removed, reaching configfs_register_group through pci_epf_cfs_work. The fix replaces delayed work with configfs_add_default_group, avoiding the race described by the kernel maintainers.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel versions where the PCI endpoint function configfs interface is present and accessible. This is most relevant to specialized, embedded, lab, or hardware-development systems using PCI endpoint functionality. Public sources do not show broad internet-facing exposure.

Exploitation context

The CVE source says the crash is easily reproducible through local configfs operations, but KEV is false and no cited source reports active exploitation. The available evidence supports local availability impact through a kernel crash, not remote code execution or privilege escalation.

Researcher notes

The root issue is a race between asynchronous subgroup creation and directory removal in PCI endpoint configfs. Source evidence names configfs_register_group, pci_epf_cfs_work, and the replacement API configfs_add_default_group. Access prerequisites, exact distribution impact, and CVSS scoring are not provided in the bundle.

Mitigation direction

  • Identify systems running affected Linux kernel versions or vendor kernels carrying this PCI endpoint code.
  • Prioritize updates to kernel builds that include the referenced stable fixes.
  • If immediate patching is unavailable, restrict access to PCI endpoint configfs management paths.
  • Check Linux distribution or appliance vendor advisories for backported fix status.
  • Treat exposed lab or embedded systems as higher priority if untrusted users have local access.

Validation and detection

  • Inventory kernel versions and vendor patch levels across relevant Linux systems.
  • Confirm whether PCI endpoint configfs functionality is enabled or mounted.
  • Review vendor kernel changelogs for the referenced PCI endpoint fix commits.
  • Check logs for kernel NULL pointer dereference crashes in PCI endpoint configfs paths.
  • Validate remediation in staging before production rollout, especially on hardware-dependent systems.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71233 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe85a2d7837622bd99c96f5bbc7f972da90c285a2, e85a2d7837622bd99c96f5bbc7f972da90c285a2, e85a2d7837622bd99c96f5bbc7f972da90c285a2, e85a2d7837622bd99c96f5bbc7f972da90c285a2, e85a2d7837622bd99c96f5bbc7f972da90c285a2, e85a2d7837622bd99c96f5bbc7f972da90c285a2, e85a2d7837622bd99c96f5bbc7f972da90c285a2unaffected
LinuxLinux5.12, 0, 5.15.201, 6.1.164, 6.6.127, 6.12.72, 6.18.11, 6.19.1, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.