CVE-2025-71233: Linux Kernel PCI Endpoint DoS Vulnerability

CVE-2025-71233 Overview

A NULL pointer dereference vulnerability has been identified in the Linux kernel's PCI endpoint subsystem. The flaw exists in the asynchronous creation of configfs sub-groups, where a delayed work handler can lead to a NULL pointer dereference when the driver directory is removed before the work completes. This race condition can be triggered through rapid directory creation and removal operations in the configfs interface.

Critical Impact

Local attackers with access to the configfs interface can cause kernel crashes through NULL pointer dereference, leading to system instability and denial of service conditions.

Affected Products

• Linux Kernel (multiple versions with PCI endpoint support)
• Systems using PCI endpoint function test driver (pci_epf_test)
• Kernel configurations with configfs enabled

Discovery Timeline

• 2026-02-18 - CVE-2025-71233 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-71233

Vulnerability Analysis

This vulnerability affects the Linux kernel's PCI endpoint configfs implementation. The root issue lies in the asynchronous nature of sub-group creation when using the configfs_register_group() API. When a delayed work handler attempts to register a configfs group while the parent directory is being removed concurrently, the kernel dereferences a NULL pointer at address 0x0000000000000088.

The vulnerability is easily reproducible through simple shell commands that rapidly create and delete directories in the configfs PCI endpoint functions path. The kernel stack trace reveals the crash occurs in configfs_register_group() when called from the pci_epf_cfs_work() delayed work handler during process_one_work() execution.

Root Cause

The vulnerability stems from a race condition in the configfs sub-group registration mechanism. The configfs_register_group() API uses a delayed work handler for asynchronous group creation to avoid potential deadlocks. However, this approach creates a window where the parent directory can be removed while the work is still pending, resulting in a NULL pointer access when the work handler finally executes.

The fix replaces configfs_register_group() with configfs_add_default_group(), which handles group creation synchronously and does not suffer from the deadlock issues that necessitated the delayed work approach in the original implementation.

Attack Vector

The attack requires local access to the system with permissions to interact with the configfs interface at /sys/kernel/config/pci_ep/functions/. An attacker can exploit this vulnerability by rapidly creating and removing directories within the PCI endpoint function test configuration path.

The crash can be triggered with the following sequence of operations in the configfs directory:

1. Navigate to /sys/kernel/config/pci_ep/functions/pci_epf_test
2. Rapidly create and remove test directories in a loop
3. The race condition between directory removal and the delayed work handler causes the NULL pointer dereference

Detection Methods for CVE-2025-71233

Indicators of Compromise

• Kernel panic logs showing NULL pointer dereference at address 0x0000000000000088
• Stack traces containing configfs_register_group, pci_epf_cfs_work, and process_one_work
• System crashes occurring during PCI endpoint configuration operations
• Unexpected kernel oops messages in /var/log/kern.log or dmesg output

Detection Strategies

• Monitor kernel logs for NULL pointer dereference events related to configfs operations
• Implement auditd rules to track access to /sys/kernel/config/pci_ep/functions/ directories
• Deploy kernel crash dump analysis to identify exploitation attempts
• Use kernel tracing tools to monitor pci_epf_cfs_work function execution

Monitoring Recommendations

• Enable kernel crash dumps (kdump) to capture full system state during crashes
• Configure syslog forwarding for kernel messages to centralized SIEM systems
• Implement file integrity monitoring on configfs mount points
• Set up alerts for repeated kernel NULL pointer dereference events

How to Mitigate CVE-2025-71233

Immediate Actions Required

• Apply the kernel patches from the official Linux kernel git repository
• Restrict access to configfs directories using appropriate filesystem permissions
• Consider disabling the pci_epf_test module if not required in production environments
• Monitor systems for signs of exploitation attempts while patches are being deployed

Patch Information

Multiple patches have been released to address this vulnerability across various kernel branches. The fix modifies the configfs sub-group creation to use configfs_add_default_group() instead of the asynchronous configfs_register_group() API.

Patches are available from the following kernel git commits:

• Kernel Git Commit 24a253c3aa6d
• Kernel Git Commit 5f609b3bffd4
• Kernel Git Commit 73cee890adaf
• Kernel Git Commit 8cb905eca739
• Kernel Git Commit d9af3cf58bb4
• Kernel Git Commit fa9fb38f5fe9

Workarounds

• Restrict access to the configfs PCI endpoint interface to trusted administrators only
• Unload or blacklist the pci_epf_test kernel module if not required for system operation
• Implement mandatory access control policies (SELinux/AppArmor) to limit configfs access
• Monitor and rate-limit directory operations in the PCI endpoint configfs path

# Configuration example
# Blacklist the pci_epf_test module if not needed
echo "blacklist pci_epf_test" >> /etc/modprobe.d/blacklist-pci-epf.conf

# Restrict configfs access permissions
chmod 700 /sys/kernel/config/pci_ep/functions/

# Verify module is not loaded
lsmod | grep pci_epf_test