In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Fix configfs group list head handling
Doing a listdel() on the epfgroup field of struct pciepfdriver in pciepfremovecfs() is not correct as this field is a list head, not a list entry. This listdel() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down:
================================================================== BUG: KASAN: slab-use-after-free in pciepfremove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319
CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: showstack+0x2c/0x84 (C) dumpstacklvl+0x70/0x98 printreport+0x17c/0x538 kasanreport+0xb8/0x190 _asanreportstore8noabort+0x20/0x2c pciepfremovecfs+0x17c/0x198 pciepfunregisterdriver+0x18/0x30 nvmetpciepfcleanupmodule+0x24/0x30 [nvmetpciepf] _arm64sysdeletemodule+0x264/0x424 invokesyscall+0x70/0x260 el0svccommon.constprop.0+0xac/0x230 doel0svc+0x40/0x58 el0svc+0x48/0xdc el0t64synchandler+0x10c/0x138 el0t64sync+0x198/0x19c ...
Remove this incorrect listdel() call from pciepfremovecfs().
{ "vanir_signatures": [ { "id": "CVE-2025-39783-22120255", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a302bd89db35d8b7e279de4d2b41c16c7f191069", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } }, { "id": "CVE-2025-39783-2e1f8205", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc4ffbd571716ff3b171418fb03abe80e720a7b1", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-33a7d080", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d79123d79a8154b4318529b7b2ff7e15806f480b", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } }, { "id": "CVE-2025-39783-3da9a9a1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d79123d79a8154b4318529b7b2ff7e15806f480b", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-48751d3c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cf65505523224cab1449d726d2ce8180c2941ee", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-4d034014", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a302bd89db35d8b7e279de4d2b41c16c7f191069", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-5ab3b056", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0758862386f114d9ab1e23181461bd1e2e9ec4c6", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } }, { "id": "CVE-2025-39783-65e5c2fc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5aecddc3452371d9da82cdbb0c715812524b54b", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-6a410f72", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cf65505523224cab1449d726d2ce8180c2941ee", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } }, { "id": "CVE-2025-39783-911fc15f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80ea6e6904fb2ba4ccb5d909579988466ec65358", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } }, { "id": "CVE-2025-39783-9662af00", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@409af8b9f7b4f23cd0464e71c6cd6fe13c076ae2", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } }, { "id": "CVE-2025-39783-a0252045", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc4ffbd571716ff3b171418fb03abe80e720a7b1", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } }, { "id": "CVE-2025-39783-b269f85c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80ea6e6904fb2ba4ccb5d909579988466ec65358", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-ead6e4c3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@409af8b9f7b4f23cd0464e71c6cd6fe13c076ae2", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-ec2425cd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0758862386f114d9ab1e23181461bd1e2e9ec4c6", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "297692170160267617657828657002578435008", "237257977906305177656600659677494882633", "150680520322294356887791805930814854166", "215498603414459460772396909530486456919" ] }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c" } }, { "id": "CVE-2025-39783-fdbcbb15", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5aecddc3452371d9da82cdbb0c715812524b54b", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 318.0, "function_hash": "125953062315466744183141078541766292793" }, "target": { "file": "drivers/pci/endpoint/pci-epf-core.c", "function": "pci_epf_remove_cfs" } } ] }