CVE-2025-40219

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI/IOV: Fix race between SR-IOV enable/disable and hotplug

Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when

enabling/disabling SR-IOV") tried to fix a race between the VF removal

inside sriov_del_vfs() and concurrent hot unplug by taking the PCI

rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock

was also taken in sriov_add_vfs() to protect addition of VFs.

This approach however causes deadlock on trying to remove PFs with SR-IOV

enabled because PFs disable SR-IOV during removal and this removal happens

under the PCI rescan/remove lock. So the original fix had to be reverted.

Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and

sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs

hotplug higher up in the callchain by taking the lock in

sriov_numvfs_store() before calling into the driver's sriov_configure()

callback.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References