PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
Summary
| CVE | CVE-2025-40219 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-12-04 15:15:57 UTC |
| Updated | 2026-07-14 13:17:53 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF removal inside sriov_del_vfs() and concurrent hot unplug by taking the PCI rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock was also taken in sriov_add_vfs() to protect addition of VFs. This approach however causes deadlock on trying to remove PFs with SR-IOV enabled because PFs disable SR-IOV during removal and this removal happens under the PCI rescan/remove lock. So the original fix had to be reverted. Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs hotplug higher up in the callchain by taking the lock in sriov_numvfs_store() before calling into the driver's sriov_configure() callback. |
Risk And Classification
EPSS: 0.001710000 probability, percentile 0.067140000 (date 2026-07-14)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 3cddde484471c602bea04e6f384819d336a1ff84 git | Not specified |
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b git | Not specified |
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 7c37920c96b85ef4255a7acc795e99e63dd38d59 git | Not specified |
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 1047ca2d816994f31e1475e63e0c0b7825599747 git | Not specified |
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 97c18f074ff1c12d016a0753072a3afdfa0b9611 git | Not specified |
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 bea1d373098b22d7142da48750ce5526096425bc git | Not specified |
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 f3015627b6e9ddf85cfeaf42405b3c194dde2c36 git | Not specified |
| CNA | Linux | Linux | affected 18f9e9d150fccfa747875df6f0a9f606740762b3 a5338e365c4559d7b4d7356116b0eb95b12e08d5 git | Not specified |
| CNA | Linux | Linux | affected 5.0 | Not specified |
| CNA | Linux | Linux | unaffected 5.0 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.252 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.202 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.165 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.128 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.75 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.16 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.19.6 6.19.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0 * original_commit_for_fix | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.6 * custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.5 * custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.6 * custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.5 * custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.6 * custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.5 * custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.6 * custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.5 * custom | Not specified |
| ADP | Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.6 * custom | Not specified |
| ADP | Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.5 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cert-portal.siemens.com/productcert/html/ssa-082556.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| git.kernel.org/stable/c/97c18f074ff1c12d016a0753072a3afdfa0b9611 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a5338e365c4559d7b4d7356116b0eb95b12e08d5 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/f3015627b6e9ddf85cfeaf42405b3c194dde2c36 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/bea1d373098b22d7142da48750ce5526096425bc | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/7c37920c96b85ef4255a7acc795e99e63dd38d59 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| cert-portal.siemens.com/productcert/html/ssa-019113.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| git.kernel.org/stable/c/3cddde484471c602bea04e6f384819d336a1ff84 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/1047ca2d816994f31e1475e63e0c0b7825599747 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.