Critical Vulnerability in Linux Package: PCI Endpoint List Handling Issue
Summary
CVE-2025-39783: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not c... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of many operating systems, providing essential functionalities for hardware interaction and system management. It is widely used in various distributions, including Debian. The package is known for its stability and performance, but like any software, it can be susceptible to vulnerabilities that may compromise system integrity and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of the configfs group list in PCI endpoint functions. Specifically, the issue arises from an incorrect use of the list_del() function on the epf_group field of the struct pci_epf_driver in the pci_epf_remove_cfs() function. This misuse can lead to a KASAN warning and a potential slab-use-after-free condition, which may allow an attacker to exploit the system, leading to crashes or unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to avoid unloading any PCI endpoint function drivers that utilize configfs attributes until the patch is applied. This can help mitigate the risk of encountering the vulnerability while waiting for an official fix.
Conclusion
The vulnerability CVE-2025-39783 in the Linux kernel poses significant risks to system stability and security. It is crucial for users to update their systems to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39783 is a vulnerability in the Linux kernel related to improper handling of PCI endpoint function drivers, which can lead to system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities like CVE-2025-39783 without needing to install any software.
The vulnerability can lead to system crashes, unauthorized access, or exploitation by attackers, compromising the security and stability of the affected systems.
Yes, a patch is available. Users should update their Linux package to the latest version to ensure the vulnerability is resolved.
If immediate updates are not possible, avoid unloading PCI endpoint function drivers that use configfs attributes as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
