CVE-2025-71313: Linux Kernel PCI Endpoint NULL Pointer Dereference

Technical summary

CVE-2025-71313 addresses a missing NULL pointer check in the Linux kernel's PCI endpoint driver (specifically in epf_ntb_epc_init()). The alloc_workqueue() function, used to allocate a kernel work queue, may return NULL on memory allocation failure. The original code did not validate this return value before passing the queue pointer to queue_work(), creating a NULL pointer dereference vulnerability (CWE-476). The patch adds immediate error checking after alloc_workqueue() and returns -ENOMEM if allocation fails, preventing the driver from initializing with an invalid workqueue reference.

Business impact

This vulnerability primarily affects system availability. Exploitation requires local access and can be triggered under memory pressure conditions, potentially causing unplanned system crashes or forced reboots. The impact is most significant for servers or embedded systems running PCI endpoint controllers that rely on NTB (Non-Transparent Bridge) functionality, where unexpected downtime disrupts service continuity. Systems not using PCI endpoint functionality are unaffected.

Affected systems

The vulnerability affects the Linux kernel across distributions that include the PCI endpoint driver. Kernel versions prior to the patch introduction are vulnerable; the exact vulnerable version range should be verified against your distribution's kernel timeline. Systems using PCI endpoint-to-endpoint communication, particularly those with NTB (Non-Transparent Bridge) configurations, are at highest risk. Embedded systems, hypervisors, and specialized servers with direct PCIe interconnection are more likely to be affected than standard consumer or office infrastructure.

Exploitability

This vulnerability requires local access (AV:L) and unprivileged user privileges (PR:L) to trigger. An attacker cannot exploit this remotely. Triggering requires inducing memory pressure on the system to cause alloc_workqueue() to fail, or loading the affected driver module when memory is constrained. No user interaction is necessary once conditions align. While not trivial to trigger intentionally, the vulnerability is deterministic—it will fail consistently under genuine low-memory conditions, making it a reliability issue as much as a security concern.

Remediation

Apply the patch that adds a NULL check following alloc_workqueue() in epf_ntb_epc_init(). The fix returns -ENOMEM and prevents driver initialization if memory allocation fails. Verify the patch version number against your distribution's kernel advisory. For most distributions, this will arrive via standard kernel security updates. Prioritize patching systems that actively use PCI endpoint functionality; systems without this hardware configuration can be assessed at lower urgency.

Patch guidance

Check your Linux distribution's kernel security advisories for the patched kernel version addressing CVE-2025-71313. Apply the latest recommended kernel update for your distribution. Most major distributions (RHEL, Ubuntu, Debian, SLES) will provide a patched kernel version through their normal security channels. Verify that the patch is included by confirming the alloc_workqueue() error-checking code in the epf_ntb driver. If compiling custom kernels, ensure your upstream kernel version includes this commit.

Detection guidance

Monitor kernel logs for memory allocation failures in the PCI endpoint driver (dmesg output will show alloc_workqueue() failures). Watch for unexpected system crashes or reboots coinciding with low-memory conditions on systems using PCI endpoint functionality. System administrators can also check the running kernel version against known vulnerable ranges for their distribution. Kernel crash dumps will show a NULL pointer dereference in queue_work() if exploitation occurs.

Why prioritize this

This is a medium-severity local denial-of-service vulnerability with straightforward remediation. Prioritize patching systems that use PCI endpoint or NTB functionality, as they face realistic exploitation risk under resource constraints. Standard workstations and servers without PCI endpoint hardware can be patched on the next scheduled maintenance window. The lack of remote exploitability and requirement for local access reduces enterprise-wide urgency, but systems using the affected hardware should be updated promptly.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects local-only attack surface (AV:L), low privileges required (PR:L), high availability impact (A:H), and no confidentiality or integrity consequences. The score appropriately captures that this is a denial-of-service vulnerability with limited attack scope—only systems with local access and using the specific driver are at risk. The straightforward nature of the fix and low barrier to patching reduce practical risk further.

Frequently asked questions