CVE-2025-39784

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix link speed calculation on retrain failure

When pcie_failed_link_retrain() fails to retrain, it tries to revert to the

previous link speed. However it calculates that speed from the Link

Control 2 register without masking out non-speed bits first.

PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to

PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in

pcie_set_target_speed():

pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port

pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s

pci 0000:00:01.1: retraining failed

WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed

RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000

pcie_failed_link_retrain

pci_device_add

pci_scan_single_device

Mask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and

PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References