CVE-2025-40032 PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
A missing NULL check in the Linux kernel PCI endpoint test driver can cause a kernel panic via NULL pointer dereference, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40032?
CVE-2025-40032 is a vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be NULL even after EPF initialization. Then it is prudent to check that they have non-NULL values before releasing the channels. Add the checks in pci_epf_test_clean_dma_chan().
Without the checks, NULL pointer dereferences happen and they can lead to a kernel panic in some cases:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Call trace: dma_release_channel+0x2c/0x120 (P) pci_epf_test_epc_deinit+0x94/0xc0 [pci_epf_test] pci_epc_deinit_notify+0x74/0xc0 tegra_pcie_ep_pex_rst_irq+0x250/0x5d8 irq_thread_fn+0x34/0xb8 irq_thread+0x18c/0x2e8 kthread+0x14c/0x210 ret_from_fork+0x10/0x20
[mani: trimmed the stack trace]
Which versions are affected by CVE-2025-40032?
How do I fix CVE-2025-40032?
Apply the vendor's patch.
Is CVE-2025-40032 being exploited?
There is no known exploitation of CVE-2025-40032 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40032, DEBIAN-CVE-2025-40032, GHSA-4chp-rv27-mr56, ROOT-OS-DEBIAN-11-CVE-2025-40032, ROOT-OS-DEBIAN-12-CVE-2025-40032, ROOT-OS-DEBIAN-13-CVE-2025-40032 and 3 more.