Executive brief
A vulnerability was identified in the Linux kernel's PCI endpoint subsystem, which manages how hardware devices communicate with the computer's processor. Under rare conditions where the system runs out of memory, the kernel could attempt to use a non-existent memory address, leading to a system crash. This could result in a denial-of-service, impacting the availability of the affected system.
Technical details
A vulnerability in the Linux kernel's PCI endpoint subsystem arises from a missing NULL check for the return value of 'alloc_workqueue()' in 'epf_ntb_epc_init()'. If 'alloc_workqueue()' fails due to memory exhaustion, it returns NULL; subsequent calls to 'queue_work()' using this pointer result in a NULL pointer dereference. This issue affects the 'pci-epf-ntb.c' and 'pci-epf-vntb.c' drivers. An attacker or a system under heavy memory pressure could trigger this condition to cause a kernel panic (DoS). The issue has been resolved by adding appropriate NULL checks and returning '-ENOMEM' to prevent the driver from loading with an invalid pointer.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2025/2026
Timeline
- 2025-11-10: disclosed: Initial patch submitted by Haotian Zhang
- 2026-06-03: advisory: CVE-2025-71313 published in NVD