CVE-2025-22092

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix NULL dereference in SR-IOV VF creation error path

Clean up when virtfn setup fails to prevent NULL pointer dereference

during device removal. The kernel oops below occurred due to incorrect

error handling flow when pci_setup_device() fails.

Add pci_iov_scan_device(), which handles virtfn allocation and setup and

cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need

to call pci_stop_and_remove_bus_device(). This prevents accessing

partially initialized virtfn devices during removal.

BUG: kernel NULL pointer dereference, address: 00000000000000d0

RIP: 0010:device_del+0x3d/0x3d0

Call Trace:

pci_remove_bus_device+0x7c/0x100

pci_iov_add_virtfn+0xfa/0x200

sriov_enable+0x208/0x420

mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core]

sriov_numvfs_store+0xae/0x1a0

[bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References