🛡️ CVE-2025-40219 — kernel

⚪ Unknown ✅ No Known Exploit NVD
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

PCI/IOV: Fix race between SR-IOV enable/disable and hotplug

In the Linux kernel, the following vulnerability has been resolved:

PCI/IOV: Fix race between SR-IOV enable/disable and hotplug

Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when

enabling/disabling SR-IOV") tried to fix a race between the VF removal

inside sriov_del_vfs() and concurrent hot unplug by taking the PCI

rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock

was also taken in sriov_add_vfs() to protect addition of VFs.

This approach however causes deadlock on trying to remove PFs with SR-IOV

enabled because PFs disable SR-IOV during removal and this removal happens

under the PCI rescan/remove lock. So the original fix had to be reverted.

Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and

sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs

hotplug higher up in the callchain by taking the lock in

sriov_numvfs_store() before calling into the driver's sriov_configure()

callback.

Affected software

CVE-2025-40219 is recorded against 2 packages.

  • kernel (from 6.19.0 up to 6.19.6)
  • unknown

Timeline and source

Published on 4 December 2025 and last revised on 16 July 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

cert-portal.siemens.com (Web)
cert-portal.siemens.com (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
github.com (Advisory)
nvd.nist.gov (Advisory)
git.kernel.org (Package)

CVE-2025-40219 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2025-12-04
Updated 2026-08-12
Modified 2026-07-16
Fix URL N/A

Affected Packages

Software From version Fixed in
kernel 6.19.0 6.19.6
unknown — —

References

Similar Threats

Free Vulnerability Check

Is your site affected by CVE-2025-40219?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2025-40219 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.