Executive brief
A vulnerability in the Linux kernel's PCI endpoint testing driver could allow a local user to cause a system crash or potentially access restricted memory. This component is typically used for testing hardware interfaces during development or diagnostics. An attacker with local access could exploit this flaw to disrupt system operations or gain unauthorized access to sensitive information.
Technical details
An array underflow vulnerability exists in the pci_endpoint_test_ioctl() function within drivers/misc/pci_endpoint_test.c. The issue was introduced when the pci_barno enum was modified to include NO_BAR (-1), effectively changing the enum type from unsigned to signed. A local attacker can provide a negative value via the PCITEST_BAR ioctl command, bypassing the existing upper-bound check (bar > BAR_5) and causing an out-of-bounds memory access in pci_endpoint_test_bar(). This can lead to a kernel crash (DoS) or local privilege escalation. The issue has been patched by adding a lower-bound check to ensure the BAR value is valid.
Affected products
- Linux Linux 6.17 to 6.17.3, 6.18
Timeline
- 2025-11-12: disclosed: CVE published
- 2025-08-13: patched: Mainline kernel fix committed