In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Fix configfs group list head handling
Doing a listdel() on the epfgroup field of struct pciepfdriver in pciepfremovecfs() is not correct as this field is a list head, not a list entry. This listdel() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down:
================================================================== BUG: KASAN: slab-use-after-free in pciepfremove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319
CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: showstack+0x2c/0x84 (C) dumpstacklvl+0x70/0x98 printreport+0x17c/0x538 kasanreport+0xb8/0x190 _asanreportstore8noabort+0x20/0x2c pciepfremovecfs+0x17c/0x198 pciepfunregisterdriver+0x18/0x30 nvmetpciepfcleanupmodule+0x24/0x30 [nvmetpciepf] _arm64sysdeletemodule+0x264/0x424 invokesyscall+0x70/0x260 el0svccommon.constprop.0+0xac/0x230 doel0svc+0x40/0x58 el0svc+0x48/0xdc el0t64synchandler+0x10c/0x138 el0t64sync+0x198/0x19c ...
Remove this incorrect listdel() call from pciepfremovecfs().
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "125953062315466744183141078541766292793",
"length": 318.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a302bd89db35d8b7e279de4d2b41c16c7f191069",
"id": "CVE-2025-39783-22120255",
"signature_version": "v1",
"target": {
"function": "pci_epf_remove_cfs",
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"297692170160267617657828657002578435008",
"237257977906305177656600659677494882633",
"150680520322294356887791805930814854166",
"215498603414459460772396909530486456919"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc4ffbd571716ff3b171418fb03abe80e720a7b1",
"id": "CVE-2025-39783-2e1f8205",
"signature_version": "v1",
"target": {
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "125953062315466744183141078541766292793",
"length": 318.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d79123d79a8154b4318529b7b2ff7e15806f480b",
"id": "CVE-2025-39783-33a7d080",
"signature_version": "v1",
"target": {
"function": "pci_epf_remove_cfs",
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"297692170160267617657828657002578435008",
"237257977906305177656600659677494882633",
"150680520322294356887791805930814854166",
"215498603414459460772396909530486456919"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d79123d79a8154b4318529b7b2ff7e15806f480b",
"id": "CVE-2025-39783-3da9a9a1",
"signature_version": "v1",
"target": {
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"297692170160267617657828657002578435008",
"237257977906305177656600659677494882633",
"150680520322294356887791805930814854166",
"215498603414459460772396909530486456919"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cf65505523224cab1449d726d2ce8180c2941ee",
"id": "CVE-2025-39783-48751d3c",
"signature_version": "v1",
"target": {
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"297692170160267617657828657002578435008",
"237257977906305177656600659677494882633",
"150680520322294356887791805930814854166",
"215498603414459460772396909530486456919"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a302bd89db35d8b7e279de4d2b41c16c7f191069",
"id": "CVE-2025-39783-4d034014",
"signature_version": "v1",
"target": {
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "125953062315466744183141078541766292793",
"length": 318.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0758862386f114d9ab1e23181461bd1e2e9ec4c6",
"id": "CVE-2025-39783-5ab3b056",
"signature_version": "v1",
"target": {
"function": "pci_epf_remove_cfs",
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"297692170160267617657828657002578435008",
"237257977906305177656600659677494882633",
"150680520322294356887791805930814854166",
"215498603414459460772396909530486456919"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5aecddc3452371d9da82cdbb0c715812524b54b",
"id": "CVE-2025-39783-65e5c2fc",
"signature_version": "v1",
"target": {
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "125953062315466744183141078541766292793",
"length": 318.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cf65505523224cab1449d726d2ce8180c2941ee",
"id": "CVE-2025-39783-6a410f72",
"signature_version": "v1",
"target": {
"function": "pci_epf_remove_cfs",
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "125953062315466744183141078541766292793",
"length": 318.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80ea6e6904fb2ba4ccb5d909579988466ec65358",
"id": "CVE-2025-39783-911fc15f",
"signature_version": "v1",
"target": {
"function": "pci_epf_remove_cfs",
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "125953062315466744183141078541766292793",
"length": 318.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc4ffbd571716ff3b171418fb03abe80e720a7b1",
"id": "CVE-2025-39783-a0252045",
"signature_version": "v1",
"target": {
"function": "pci_epf_remove_cfs",
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"297692170160267617657828657002578435008",
"237257977906305177656600659677494882633",
"150680520322294356887791805930814854166",
"215498603414459460772396909530486456919"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80ea6e6904fb2ba4ccb5d909579988466ec65358",
"id": "CVE-2025-39783-b269f85c",
"signature_version": "v1",
"target": {
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"297692170160267617657828657002578435008",
"237257977906305177656600659677494882633",
"150680520322294356887791805930814854166",
"215498603414459460772396909530486456919"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0758862386f114d9ab1e23181461bd1e2e9ec4c6",
"id": "CVE-2025-39783-ec2425cd",
"signature_version": "v1",
"target": {
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "125953062315466744183141078541766292793",
"length": 318.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5aecddc3452371d9da82cdbb0c715812524b54b",
"id": "CVE-2025-39783-fdbcbb15",
"signature_version": "v1",
"target": {
"function": "pci_epf_remove_cfs",
"file": "drivers/pci/endpoint/pci-epf-core.c"
}
}
]