CVE-2025-40219

Vulnerability

Analysis

CVE-2025-40219 describes a race condition in the Linux kernel's PCI/IOV subsystem. The bug occurs between SR-IOV enable/disable operations and hot plug events. A previous fix attempt (commit 05703271c3cd) took the PCI rescan-remove lock in sriov_del_vfs() and sriov_add_vfs(), but this caused a deadlock when removing a PF with SR-IOV enabled because PF removal already holds that lock.

Exploitation

The race can be triggered by an attacker with local access who can concurrently initiate SR-IOV configuration changes (e.g., writing to sriov_numvfs) and hot unplug or hot add events. No special privileges beyond the ability to manage PCI devices are required, though the attack surface is limited to systems with SR-IOV capable hardware.

Impact

A successful exploit may lead to use-after-free or other memory corruption, resulting in system crashes or potential privilege escalation. The exact impact depends on the driver and hardware, but the vulnerability is classified with a CVSS score indicating moderate severity.

Mitigation

The fix is included in Linux kernel stable updates. It moves the lock acquisition from sriov_add_vfs() and sriov_del_vfs() to sriov_numvfs_store(), acquiring the PCI rescan-remove lock before calling the driver's sriov_configure() callback. Users should apply the latest kernel patches to mitigate this vulnerability.