CVE-2025-71233: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71233 is a NULL pointer dereference vulnerability in the Linux kernel's PCI endpoint configuration subsystem (CWE-476). It affects the pci_epf_cfs_work delayed work handler in the configfs interface for PCI endpoint functions, where asynchronous sub-group creation can race with directory removal, triggering a kernel panic. Affected kernel versions include 5.12–5.15.200, 5.16–6.1.163, 6.2–6.6.126, 6.7–6.12.71, 6.13–6.18.10, and 6.19.0. It was published on February 18, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a race condition in the PCI endpoint function configfs subsystem (CWE-476): when a driver directory under /sys/kernel/config/pci_ep/functions/pci_epf_test is removed before a delayed work item (pci_epf_cfs_work) completes, the work handler calls configfs_register_group() on a now-invalid (NULL) parent, causing a kernel NULL pointer dereference at address 0x0000000000000088. The fix replaces the asynchronous delayed work approach with the synchronous configfs_add_default_group() API, which avoids both the deadlock risk of configfs_register_group() and the race condition. Exploitation requires local access and the ability to rapidly create and remove directories in the configfs PCI endpoint interface (Red Hat CVE, Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic (BUG) and system crash — a complete denial of service. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The affected asset is any Linux system with the PCI endpoint function configfs interface exposed and accessible to low-privileged local users (Red Hat CVE, Feedly).

1. Gain local access: Obtain a low-privileged local shell on a vulnerable Linux system (kernel versions 5.12–5.15.200, 5.16–6.1.163, 6.2–6.6.126, 6.7–6.12.71, 6.13–6.18.10, or 6.19.0) with access to the configfs PCI endpoint interface.
2. Navigate to the target directory: Change to the PCI endpoint function configfs path: cd /sys/kernel/config/pci_ep/functions/pci_epf_test.
3. Trigger the race condition: Rapidly and repeatedly create and remove a subdirectory to race directory removal against the delayed work handler: for i in {1..20}; do mkdir test && rmdir test; done.
4. Kernel panic: The delayed work item pci_epf_cfs_work attempts to call configfs_register_group() on the already-removed directory, dereferencing a NULL pointer and triggering a kernel BUG/panic, crashing the system (Red Hat CVE, Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000088 with a call trace including configfs_register_group, pci_epf_cfs_work, process_one_work, and worker_thread.
• File System: Rapid creation and deletion of directories under /sys/kernel/config/pci_ep/functions/pci_epf_test/ visible in audit logs or inotify watches.
• Process: Unusual or repeated mkdir/rmdir system calls targeting /sys/kernel/config/pci_ep/ from a low-privileged user process, detectable via auditd or strace (Red Hat CVE, Feedly).

Apply the available kernel patches for the relevant stable branch: 5.15.201+, 6.1.164+, 6.6.127+, 6.12.72+, 6.18.11+, or 6.19.1+. Patches are available at kernel.org and Microsoft has released updates for CBL-Mariner 2 (kernel 5.15.200.1-1) and Azure Linux 3 (kernel 6.6.126.1-1). As a workaround on unpatched systems, restrict unprivileged user access to /sys/kernel/config/pci_ep/ using appropriate filesystem permissions or by not loading the pci_epf_test module if it is not required (Red Hat CVE, Microsoft MSRC, Feedly).

Debian issued security advisories (DSA-6141-1, DSA-6163-1, DLA-4499-1) addressing this and related kernel vulnerabilities in their stable and LTS branches. The Yocto Project security mailing list also flagged the CVE for embedded Linux users. No notable independent researcher commentary or significant social media discussion has been observed beyond routine vendor patch tracking (Debian LTS Announce, Feedly).