BaseFortify

Publication date: 2025-10-24

Last updated on: 2025-10-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_CAP(0x138340) register nor access PCODE (already guarded by the info.skip_pcode flag) so we shouldn't expose attributes that require any of them to avoid errors like: [] xe 0000:03:00.1: [drm] Tile0: GT0: VF is trying to read an \ inaccessible register 0x138340+0x0 [] RIP: 0010:xe_gt_sriov_vf_read32+0x6c2/0x9a0 [xe] [] Call Trace: [] xe_mmio_read32+0x110/0x280 [xe] [] auto_link_downgrade_capable_show+0x2e/0x70 [xe] [] dev_attr_show+0x1a/0x70 [] sysfs_kf_seq_show+0xaa/0x120 [] kernfs_seq_show+0x41/0x60 (cherry picked from commit a2d6223d224f333f705ed8495bf8bebfbc585c35)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-24

Last Modified

2025-10-27

Generated

2026-07-06

AI Q&A

2025-10-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40023

EUVD

EUVD-2025-35836

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Linux kernel's drm/xe/vf component exposing sysfs attributes that are not applicable for Virtual Functions (VFs). Specifically, VFs cannot read the BMG_PCIE_CAP register or access PCODE, but the kernel was exposing attributes that require these accesses, leading to errors when VFs attempt to read inaccessible registers. The fix prevents exposing these attributes to avoid such errors.

Impact Analysis

If unpatched, this vulnerability can cause errors and instability when Virtual Functions attempt to read sysfs attributes that they are not permitted to access. This could lead to system errors or degraded functionality related to device management in environments using SR-IOV with VFs.

Hi! I’m here to help you understand CVE-2025-40023. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70