CVE-2025-22092: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel was identified and assigned CVE-2025-22092, discovered on April 16, 2025. The issue involves a NULL pointer dereference in the SR-IOV VF (Single Root I/O Virtualization Virtual Function) creation error path, specifically affecting PCI device handling (NVD CVE).

The vulnerability stems from incorrect error handling flow when pci_setup_device() fails. The issue manifests as a kernel oops due to NULL pointer dereference during device removal, occurring at address 0x00000000000000d0. The technical trace shows the error propagating through device_del, pci_remove_bus_device, pci_iov_add_virtfn, sriov_enable, and mlx5_core_sriov_configure functions. Red Hat has assigned this vulnerability a CVSS v3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat CVE).

The vulnerability can lead to a kernel crash when handling PCI device removal operations, particularly affecting systems utilizing SR-IOV virtualization features. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (Red Hat CVE).

The vulnerability requires local access and low privileges to exploit. The attack complexity is considered low, but user interaction is not required for exploitation (Red Hat CVE).

A fix has been implemented by adding pci_iov_scan_device() function, which properly handles virtfn allocation and setup, including cleanup procedures when pci_setup_device() fails. This prevents the access to partially initialized virtfn devices during removal. The fix has been incorporated into various Linux distributions, with Red Hat Enterprise Linux 8 and 9 being noted as not affected (Debian Tracker, Red Hat CVE).