CVE-2025-40219: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40219 is a race condition vulnerability in the Linux kernel's PCI/IOV (Single Root I/O Virtualization) subsystem that can lead to system instability or kernel crashes. The flaw arises from improper synchronization when enabling or disabling SR-IOV virtual functions concurrently with PCI hotplug operations. It was published on December 4, 2025, and affects the Linux kernel, including Microsoft's Azure Linux 3 kernel package (azl3_kernel_6.6.112.1-2). It carries a CVSS v3.1 base score of 5.5 (Medium) (MSRC).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the Linux kernel's sriov_numvfs_store(), sriov_add_vfs(), and sriov_del_vfs() functions. A prior fix (commit 05703271c3cd) attempted to address a race between VF removal and concurrent hot unplug by taking the PCI rescan/remove lock inside sriov_del_vfs() and sriov_add_vfs(), but this introduced a deadlock when removing PFs with SR-IOV enabled (since PF removal also holds the PCI rescan/remove lock). The correct fix moves the lock acquisition higher in the call chain — into sriov_numvfs_store() before invoking the driver's sriov_configure() callback — properly serializing SR-IOV enable/disable against hotplug events. Exploitation requires local access with low privileges (MSRC).

Successful exploitation can cause list corruption and kernel crashes, primarily impacting system availability. The vulnerability has no confidentiality or integrity impact, but can result in unexpected device behavior, system instability, or denial of service, particularly on s390 platforms using virtualized PCI devices. The scope is limited to the affected system and does not enable lateral movement or data exfiltration (MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to trigger concurrent SR-IOV enable/disable and hotplug operations (MSRC).

The primary remediation is to update to a patched Linux kernel version that incorporates the fix moving the PCI rescan/remove lock into sriov_numvfs_store(). Patches have been applied to stable kernel trees (referenced via kernel.org commits 3cddde484471, 7c37920c96b8, 97c18f074ff1, and 1047ca2d8169). Downstream distributions including Debian (DLA-4404-1, DSA-6238-1, DSA-6243-1, DLA-4561-1), Amazon Linux 2 (ALAS2KERNEL-5.4-2025-114, ALAS2KERNEL-5.15-2025-095, ALAS2KERNEL-5.10-2026-112), Red Hat, SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), and Oracle Linux have released updated kernel packages. Administrators should apply the relevant kernel update for their distribution and reboot. As a temporary measure, avoid concurrent SR-IOV configuration changes and PCI hotplug operations on affected systems (MSRC).