Skip to main content

Linux Kernel CVE-2025-40117

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local device-node access with a low-privileged account (AV:L/PR:L), trivially triggered negative index (AC:L), yielding kernel OOB memory corruption with high confidentiality, integrity and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 09:17 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 09:15 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()

Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") added NO_BAR (-1) to the pci_barno enum which, in practical terms, changes the enum from an unsigned int to a signed int. If the user passes a negative number in pci_endpoint_test_ioctl() then it results in an array underflow in pci_endpoint_test_bar().

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.

Technical ContextAI

The affected component is drivers/misc/pci_endpoint_test.c, a Linux misc-device driver used to exercise and validate PCI Endpoint (EP) controller functionality, typically via the /dev/pci-endpoint-test.N character device and its ioctl interface. The root cause is an unbounded/underflowed array index: pci_barno was an enumeration intended to index the six PCI Base Address Registers (BAR0-BAR5), but adding the sentinel NO_BAR = -1 changed the enum's underlying type from unsigned to signed. Because pci_endpoint_test_ioctl() takes a BAR number from userspace and passes it to pci_endpoint_test_bar() without a lower-bound check, a negative value indexes memory before the bar[] array - a classic out-of-bounds access (CWE-124 buffer underwrite / CWE-129 improper validation of array index), even though the input lists CWE as N/A. Depending on how the underflowed pointer is dereferenced, this yields out-of-bounds read/write against kernel memory adjacent to the device structure.

Affected ProductsAI

The vulnerability affects the Linux kernel, specifically the drivers/misc/pci_endpoint_test.c driver, on versions that include commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") which introduced the NO_BAR (-1) sentinel and the signed-enum regression. No CPE strings were provided in the input, so exact version ranges are not enumerated in NVD data available here; the fix is tracked upstream via the stable kernel git tree (git.kernel.org commits 1ad82f9db13d85667366044acdfb02009d576c5a and 6df3687922570f753574c40b35e83b26b32292d0). A third-party advisory is available at VulDB (https://vuldb.com/vuln/332123). Only kernels that actually build and load the pci_endpoint_test module and expose its device node are practically exposed.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree commits that add lower-bound validation on the user-supplied BAR index in pci_endpoint_test_ioctl()/pci_endpoint_test_bar() (git.kernel.org/stable/c/1ad82f9db13d85667366044acdfb02009d576c5a and git.kernel.org/stable/c/6df3687922570f753574c40b35e83b26b32292d0), or update to a distribution kernel that has backported them. Until a patched kernel is deployed, the most effective compensating control is to prevent the driver from being loaded on production systems that do not need PCI endpoint testing - blacklist the pci_endpoint_test module (e.g. via modprobe blacklist) and confirm no /dev/pci-endpoint-test.N nodes are present; the trade-off is loss of PCI EP test functionality, which is irrelevant on normal production hosts. Where the module must remain, restrict access to its device node to trusted administrators via strict file permissions/udev rules, accepting that this only narrows, not eliminates, the local attack surface. Cross-reference the VulDB advisory (https://vuldb.com/vuln/332123) for tracking.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40117 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy