CVE-2025-71233: Linux Kernel PCI Endpoint DoS Vulnerability

CVE-2025-71233 Overview

A NULL pointer dereference vulnerability has been identified in the Linux kernel's PCI endpoint subsystem. The flaw exists in the asynchronous creation of configfs sub-groups, where a delayed work handler can lead to a NULL pointer dereference when the driver directory is removed before the work completes. This race condition can be triggered through rapid directory creation and removal operations in the configfs interface.

Critical Impact
Local attackers with access to the configfs interface can cause kernel crashes through NULL pointer dereference, leading to system instability and denial of service conditions.

Affected Products

Linux Kernel (multiple versions with PCI endpoint support)
Systems using PCI endpoint function test driver (pci_epf_test)
Kernel configurations with configfs enabled

Discovery Timeline

2026-02-18 - CVE-2025-71233 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-71233

Vulnerability Analysis

This vulnerability affects the Linux kernel's PCI endpoint configfs implementation. The root issue lies in the asynchronous nature of sub-group creation when using the configfs_register_group() API. When a delayed work handler attempts to register a configfs group while the parent directory is being removed concurrently, the kernel dereferences a NULL pointer at address 0x0000000000000088.

The vulnerability is easily reproducible through simple shell commands that rapidly create and delete directories in the configfs PCI endpoint functions path. The kernel stack trace reveals the crash occurs in configfs_register_group() when called from the pci_epf_cfs_work() delayed work handler during process_one_work() execution.

Root Cause

The vulnerability stems from a race condition in the configfs sub-group registration mechanism. The configfs_register_group() API uses a delayed work handler for asynchronous group creation to avoid potential deadlocks. However, this approach creates a window where the parent directory can be removed while the work is still pending, resulting in a NULL pointer access when the work handler finally executes.

The fix replaces configfs_register_group() with configfs_add_default_group(), which handles group creation synchronously and does not suffer from the deadlock issues that necessitated the delayed work approach in the original implementation.

Attack Vector

The attack requires local access to the system with permissions to interact with the configfs interface at /sys/kernel/config/pci_ep/functions/. An attacker can exploit this vulnerability by rapidly creating and removing directories within the PCI endpoint function test configuration path.

The crash can be triggered with the following sequence of operations in the configfs directory:

Navigate to /sys/kernel/config/pci_ep/functions/pci_epf_test
Rapidly create and remove test directories in a loop
The race condition between directory removal and the delayed work handler causes the NULL pointer dereference

Detection Methods for CVE-2025-71233

Indicators of Compromise

Kernel panic logs showing NULL pointer dereference at address 0x0000000000000088
Stack traces containing configfs_register_group, pci_epf_cfs_work, and process_one_work
System crashes occurring during PCI endpoint configuration operations
Unexpected kernel oops messages in /var/log/kern.log or dmesg output

Detection Strategies

Monitor kernel logs for NULL pointer dereference events related to configfs operations
Implement auditd rules to track access to /sys/kernel/config/pci_ep/functions/ directories
Deploy kernel crash dump analysis to identify exploitation attempts
Use kernel tracing tools to monitor pci_epf_cfs_work function execution

Monitoring Recommendations

Enable kernel crash dumps (kdump) to capture full system state during crashes
Configure syslog forwarding for kernel messages to centralized SIEM systems
Implement file integrity monitoring on configfs mount points
Set up alerts for repeated kernel NULL pointer dereference events

How to Mitigate CVE-2025-71233

Immediate Actions Required

Apply the kernel patches from the official Linux kernel git repository
Restrict access to configfs directories using appropriate filesystem permissions
Consider disabling the pci_epf_test module if not required in production environments
Monitor systems for signs of exploitation attempts while patches are being deployed

Patch Information

Multiple patches have been released to address this vulnerability across various kernel branches. The fix modifies the configfs sub-group creation to use configfs_add_default_group() instead of the asynchronous configfs_register_group() API.

Patches are available from the following kernel git commits:

Workarounds

Restrict access to the configfs PCI endpoint interface to trusted administrators only
Unload or blacklist the pci_epf_test kernel module if not required for system operation
Implement mandatory access control policies (SELinux/AppArmor) to limit configfs access
Monitor and rate-limit directory operations in the PCI endpoint configfs path

bash

# Configuration example
# Blacklist the pci_epf_test module if not needed
echo "blacklist pci_epf_test" >> /etc/modprobe.d/blacklist-pci-epf.conf

# Restrict configfs access permissions
chmod 700 /sys/kernel/config/pci_ep/functions/

# Verify module is not loaded
lsmod | grep pci_epf_test