CVE-2025-22031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion

When BIOS neglects to assign bus numbers to PCI bridges, the kernel

attempts to correct that during PCI device enumeration. If it runs out

of bus numbers, no pci_bus is allocated and the "subordinate" pointer in

the bridge's pci_dev remains NULL.

The PCIe bandwidth controller erroneously does not check for a NULL

subordinate pointer and dereferences it on probe.

Bandwidth control of unusable devices below the bridge is of questionable

utility, so simply error out instead. This mirrors what PCIe hotplug does

since commit 62e4492c3063 ("PCI: Prevent NULL dereference during pciehp

probe").

The PCI core emits a message with KERN_INFO severity if it has run out of

bus numbers. PCIe hotplug emits an additional message with KERN_ERR

severity to inform the user that hotplug functionality is disabled at the

bridge. A similar message for bandwidth control

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References