CVE-2025-39783

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-39783
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39783.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-39783
Downstream
Related
Published
2025-09-11T16:56:33.376Z
Modified
2026-05-10T18:42:09.905183859Z
Summary
PCI: endpoint: Fix configfs group list head handling
Details

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: Fix configfs group list head handling

Doing a listdel() on the epfgroup field of struct pciepfdriver in pciepfremovecfs() is not correct as this field is a list head, not a list entry. This listdel() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down:

================================================================== BUG: KASAN: slab-use-after-free in pciepfremove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319

CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: showstack+0x2c/0x84 (C) dumpstacklvl+0x70/0x98 printreport+0x17c/0x538 kasan_report+0xb8/0x190 __asanreportstore8noabort+0x20/0x2c pciepfremovecfs+0x17c/0x198 pciepfunregisterdriver+0x18/0x30 nvmetpciepfcleanupmodule+0x24/0x30 [nvmetpci_epf] __arm64sysdeletemodule+0x264/0x424 invokesyscall+0x70/0x260 el0svccommon.constprop.0+0xac/0x230 doel0svc+0x40/0x58 el0svc+0x48/0xdc el0t64synchandler+0x10c/0x138 el0t64sync+0x198/0x19c ...

Remove this incorrect listdel() call from pciepfremovecfs().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39783.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ef1433f717a2c63747a519d86965d73ff9bd08b3
Fixed
80ea6e6904fb2ba4ccb5d909579988466ec65358
Fixed
d5aecddc3452371d9da82cdbb0c715812524b54b
Fixed
dc4ffbd571716ff3b171418fb03abe80e720a7b1
Fixed
409af8b9f7b4f23cd0464e71c6cd6fe13c076ae2
Fixed
0758862386f114d9ab1e23181461bd1e2e9ec4c6
Fixed
6cf65505523224cab1449d726d2ce8180c2941ee
Fixed
a302bd89db35d8b7e279de4d2b41c16c7f191069
Fixed
d79123d79a8154b4318529b7b2ff7e15806f480b

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39783.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.18.0
Fixed
5.4.297
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.241
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.190
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.149
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.103
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.44
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.16.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39783.json"