CVE-2025-40117
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-12

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") added NO_BAR (-1) to the pci_barno enum which, in practical terms, changes the enum from an unsigned int to a signed int. If the user passes a negative number in pci_endpoint_test_ioctl() then it results in an array underflow in pci_endpoint_test_bar().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-12
Last Modified
2025-11-12
Generated
2026-06-16
AI Q&A
2025-11-13
EPSS Evaluated
2026-06-14
NVD
CVE-2025-40117
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an array underflow in the Linux kernel's pci_endpoint_test_ioctl() function. It occurs because the pci_barno enum was changed from unsigned to signed, allowing a negative number to be passed. When a negative number is used, it causes an array underflow in pci_endpoint_test_bar(), potentially leading to unexpected behavior or memory corruption.

Impact Analysis

The array underflow caused by passing a negative number could lead to memory corruption or unexpected behavior in the Linux kernel, which might be exploited to cause system instability or potentially escalate privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-40117. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart