CVE-2025-22095

A flaw was found in the Linux kernel's Broadcom STB PCIe host controller driver. An improper error-handling routine fails to reset the regulator count if regulator initialization fails. If a subsequent PCIe link-up failure occurs, the driver attempts to free unallocated resources, triggering a kernel panic. A local user could exploit this flaw under specific failure conditions to cause a Denial of Service (DoS).

This vulnerability is rated as Low severity because it requires specific Broadcom Set-Top Box SoC hardware and relies on an uncommon sequence of hardware initialization failures to trigger a denial of service. The affected PCIe host controller driver is not used on standard enterprise server architectures and is constrained to specialized embedded platforms. Furthermore, triggering the condition requires local privileges and cannot be achieved remotely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.