CVE-2025-40076

Source
https://cve.org/CVERecord?id=CVE-2025-40076
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40076.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40076
Downstream
Published
2025-10-28T11:48:42.385Z
Modified
2025-12-01T19:32:28.016652Z
Summary
PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()
Details

In the Linux kernel, the following vulnerability has been resolved:

PCI: rcar-host: Pass proper IRQ domain to generichandledomain_irq()

Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to msicreateparentirqdomain()"), the MSI parent IRQ domain is NULL because the object of type struct irqdomaininfo passed to:

msicreateparentirqdomain() -> irqdomaininstantiate()() -> _irqdomain_instantiate()

has no reference to the parent IRQ domain. Using msi->domain->parent as an argument for generichandledomain_irq() leads to below error:

"Unable to handle kernel NULL pointer dereference at virtual address"

This error was identified while switching the upcoming RZ/G3S PCIe host controller driver to msicreateparentirqdomain() (which was using a similar pattern to handle MSIs (see link section)), but it was not tested on hardware using the pcie-rcar-host controller driver due to lack of hardware.

[mani: reworded subject and description]

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40076.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
dd26c1a23fd5a607c50738ea0dcb6cdbb8185cfe
Fixed
e8e21aaf5d34015901cd271053a67a62b4204526
Fixed
d3fee10e40a938331e2aae34348691136db31304

Affected versions

v6.*
v6.16
v6.16-rc2
v6.16-rc3
v6.16-rc4
v6.16-rc5
v6.16-rc6
v6.16-rc7
v6.17
v6.17-rc1
v6.17-rc2
v6.17-rc3
v6.17-rc4
v6.17-rc5
v6.17-rc6
v6.17-rc7
v6.17.1
v6.17.2

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40076.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.17.0
Fixed
6.17.3

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40076.json"