Linux Kernel EUVD-2025-210056

Exploitation requires: (1) local access with at least low-privilege credentials on the target system (CVSS PR:L confirmed); (2) the target system must be configured as a PCI endpoint device with dedicated endpoint controller hardware - standard servers and workstations operating in PCIe root-complex (host) mode are entirely unaffected; (3) the epf_ntb kernel module must be loaded or in the process of loading; (4) a memory allocation failure must occur at the alloc_workqueue() call site during epf_ntb_epc_init(), requiring either naturally exhausted kernel memory or deliberate memory pressure. Exploitation is bounded by the combination of specialized hardware (PCI endpoint controllers), an unusual kernel mode, and a transient failure condition, making accidental trigger more plausible than reliable deliberate exploitation.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a score of 5.5 (Medium), correctly characterizing this as a local, low-complexity attack requiring low privileges with no user interaction, producing high availability impact (kernel crash) and no confidentiality or integrity loss. The EPSS score of 0.02% at the 5th percentile strongly aligns with low exploitation probability, reflecting the narrow preconditions: local access plus specialized PCI endpoint hardware plus a triggered memory allocation failure. The vulnerability is not listed in CISA KEV, and no POC code has been identified, making this a maintenance-priority finding rather than an emergency. The CVSS local attack vector is consistent with the description - no network exploitation path exists. The primary real-world risk is accidental kernel panic under memory pressure rather than deliberate targeted exploitation, further reducing urgency for most deployments.

A local user with standard privileges on a system acting as a PCI endpoint device (e.g., an embedded platform or specialized NTB appliance) deliberately or incidentally induces memory pressure during epf_ntb driver initialization. When alloc_workqueue() returns NULL due to the allocation failure and queue_work() is subsequently called with that NULL pointer, the kernel dereferences address 0x0, triggering a kernel panic and immediate system crash. No public exploit code has been identified at time of analysis.