CVE-2025-71313
PCI Endpoint NULL Pointer Dereference in Linux Kernel
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's PCI endpoint driver where a missing NULL check after calling alloc_workqueue() can cause a NULL pointer dereference.
alloc_workqueue() may return NULL if memory allocation fails. Without checking for this NULL return value, the code later calls queue_work() with a NULL pointer, leading to a potential crash or undefined behavior.
The fix involves adding a NULL check immediately after alloc_workqueue() and returning an error (-ENOMEM) if the allocation fails, preventing the driver from loading with an invalid workqueue pointer.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to dereference a NULL pointer, which may lead to a kernel crash or system instability.
Such crashes can result in denial of service conditions, potentially disrupting normal system operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the Linux kernel version you are using includes the fix that adds a NULL check immediately after alloc_workqueue() in the PCI endpoint driver.
This fix prevents the driver from loading with an invalid workqueue pointer by returning -ENOMEM on failure, thus avoiding a NULL pointer dereference.
If you are maintaining custom or backported kernel code, verify that the alloc_workqueue() call is properly checked for NULL and handle the error accordingly.