In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Fix configfs group list head handling
Doing a list_del() on the epf_group field of struct pci_epf_driver in
pci_epf_remove_cfs() is not correct as this field is a list head, not
a list entry. This list_del() call triggers a KASAN warning when an
endpoint function driver which has a configfs attribute group is torn
down:
==================================================================
BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198
Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319
CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE
Hardware name: Radxa ROCK 5B (DT)
Call trace:
show_stack+0x2c/0x84 (C)
dump_stack_lvl+0x70/0x98
print_report+0x17c/0x538
kasan_report+0xb8/0x190
__asan_report_store8_noabort+0x20/0x2c
pci_epf_remove_cfs+0x17c/0x198
pci_epf_unregister_driver+0x18/0x30
nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf]
__arm64_sys_delete_module+0x264/0x424
invoke_syscall+0x70/0x260
el0_svc_common.constprop.0+0xac/0x230
do_el0_svc+0x40/0x58
el0_svc+0x48/0xdc
el0t_64_sync_handler+0x10c/0x138
el0t_64_sync+0x198/0x19c
...
Remove this incorrect list_del() call from pci_epf_remove_cfs().
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
16 Jan 2026, 20:24
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CWE | CWE-787 | |
| First Time |
Linux
Debian Debian debian Linux Linux linux Kernel |
|
| References | () https://git.kernel.org/stable/c/0758862386f114d9ab1e23181461bd1e2e9ec4c6 - Patch | |
| References | () https://git.kernel.org/stable/c/409af8b9f7b4f23cd0464e71c6cd6fe13c076ae2 - Patch | |
| References | () https://git.kernel.org/stable/c/6cf65505523224cab1449d726d2ce8180c2941ee - Patch | |
| References | () https://git.kernel.org/stable/c/80ea6e6904fb2ba4ccb5d909579988466ec65358 - Patch | |
| References | () https://git.kernel.org/stable/c/a302bd89db35d8b7e279de4d2b41c16c7f191069 - Patch | |
| References | () https://git.kernel.org/stable/c/d5aecddc3452371d9da82cdbb0c715812524b54b - Patch | |
| References | () https://git.kernel.org/stable/c/d79123d79a8154b4318529b7b2ff7e15806f480b - Patch | |
| References | () https://git.kernel.org/stable/c/dc4ffbd571716ff3b171418fb03abe80e720a7b1 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory | |
| CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
03 Nov 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Sep 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-11 17:15
Updated : 2026-01-16 20:24
NVD link : CVE-2025-39783
Mitre link : CVE-2025-39783
CVE.ORG link : CVE-2025-39783
JSON object : View
Products Affected
debian
- debian_linux
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write