CVE-2025-22031: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in the Linux kernel's PCI/bwctrl component, identified as CVE-2025-22031. The vulnerability was disclosed on April 16, 2025, affecting the PCIe bandwidth controller functionality when BIOS fails to assign bus numbers to PCI bridges during device enumeration (NVD, Red Hat).

The vulnerability occurs when the BIOS neglects to assign bus numbers to PCI bridges during PCI device enumeration. In such cases, if the system runs out of bus numbers, no pcibus is allocated and the 'subordinate' pointer in the bridge's pcidev remains NULL. The PCIe bandwidth controller fails to check for this NULL subordinate pointer and attempts to dereference it during probe operations. The issue has received a CVSS v3.1 Base Score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

When triggered, the vulnerability results in a kernel NULL pointer dereference, which can cause system crashes. The impact is primarily on system availability, as evidenced by the error messages showing kernel NULL pointer dereference and system crashes (NVD).

The fix involves implementing a check for NULL subordinate pointers before dereferencing them in the PCIe bandwidth controller. This mirrors the approach taken in PCIe hotplug functionality. The PCI core now emits a message with KERN_INFO severity when it runs out of bus numbers (NVD).