CVE-2025-22092 — PCI: Fix NULL dereference in SR-IOV VF creation error path

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix NULL dereference in SR-IOV VF creation error path

Clean up when virtfn setup fails to prevent NULL pointer dereference
during device removal. The kernel oops below occurred due to incorrect
error handling flow when pci_setup_device() fails.

Add pci_iov_scan_device(), which handles virtfn allocation and setup and
cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need
to call pci_stop_and_remove_bus_device(). This prevents accessing
partially initialized virtfn devices during removal.

BUG: kernel NULL pointer dereference, address: 00000000000000d0
RIP: 0010:device_del+0x3d/0x3d0
Call Trace:
pci_remove_bus_device+0x7c/0x100
pci_iov_add_virtfn+0xfa/0x200
sriov_enable+0x208/0x420
mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]
sriov_numvfs_store+0xae/0x1a0

[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]

Affected products

Vendor	Product	Affected	Fixed
Linux	Linux	6.13	6.13.11

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 25.10	linux-azure-fde	No fix yet	—
Ubuntu 25.04	linux	6.14.0-22.22	USN-7594-1
Ubuntu 25.04	linux-aws +3	6.14.0-1007.7	USN-7594-3, USN-7594-2, USN-7594-1
Ubuntu 25.04	linux-gcp	6.14.0-1008.8	USN-7594-1
Ubuntu 25.04	linux-realtime	6.14.0-1004.4	USN-7594-1
Ubuntu 24.04 LTS	linux-realtime +1	No fix yet	—
Ubuntu 22.04 LTS	linux-riscv +32	No fix yet	—
Ubuntu 20.04 LTS	linux-gke +28	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	linux-gcp +14	No fix yet	—
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—

Red Hat