CVE-2025-71233

A flaw was found in the Linux kernel. A local user with administrative privileges can trigger a NULL pointer dereference, a type of memory corruption vulnerability, in the PCI endpoint configfs code. This occurs when a user removes a driver directory before an asynchronously created sub-group operation completes. Successful exploitation leads to a kernel crash, resulting in a Denial of Service (DoS).

A NULL pointer dereference can occur in the PCI endpoint configfs code because sub groups were created asynchronously using delayed work. If a user removes the driver directory before the delayed work runs the work handler can call configfs_register_group on freed or partially torn down objects and crash the kernel. For the CVSS the PR is H because writing to configfs and creating PCI endpoint function entries typically requires administrative privileges. The issue is not network reachable and is triggered by local filesystem operations on configfs entries. Impact is denial of service through a kernel crash and there is no clear indication of confidentiality or integrity impact from this NULL dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.