CVE-2025-71233 PCI: endpoint: Avoid creating sub-groups asynchronously
A local attacker can trigger a kernel crash via a race condition in PCI endpoint configfs operations, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71233?
CVE-2025-71233 is a medium-severity vulnerability in Linux kernel, published on 18 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Avoid creating sub-groups asynchronously
The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes.
The crash can be easily reproduced with the following commands:
# cd /sys/kernel/config/pci_ep/functions/pci_epf_test # for i in {1..20}; do mkdir test && rmdir test; done
BUG: kernel NULL pointer dereference, address: 0000000000000088 ... Call Trace: configfs_register_group+0x3d/0x190 pci_epf_cfs_work+0x41/0x110 process_one_work+0x18f/0x350 worker_thread+0x25a/0x3a0
Fix this issue by using configfs_add_default_group() API which does not have the deadlock problem as configfs_register_group() and does not require the delayed work handler.
[mani: slightly reworded the description and added stable list]
Weakness: CWE-476
Which versions are affected by CVE-2025-71233?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71233?
Apply the vendor's patch.
Is CVE-2025-71233 being exploited?
There is no known exploitation of CVE-2025-71233 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-77951, BELL-CVE-2025-71233, DEBIAN-CVE-2025-71233, GHSA-78xc-39m5-v2c6, ROOT-OS-DEBIAN-11-CVE-2025-71233, ROOT-OS-DEBIAN-12-CVE-2025-71233 and 3 more.