CVE-2025-71233

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI: endpoint: Avoid creating sub-groups asynchronously<br /> <br /> The asynchronous creation of sub-groups by a delayed work could lead to a<br /> NULL pointer dereference when the driver directory is removed before the<br /> work completes.<br /> <br /> The crash can be easily reproduced with the following commands:<br /> <br /> # cd /sys/kernel/config/pci_ep/functions/pci_epf_test<br /> # for i in {1..20}; do mkdir test &amp;&amp; rmdir test; done<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000088<br /> ...<br /> Call Trace:<br /> configfs_register_group+0x3d/0x190<br /> pci_epf_cfs_work+0x41/0x110<br /> process_one_work+0x18f/0x350<br /> worker_thread+0x25a/0x3a0<br /> <br /> Fix this issue by using configfs_add_default_group() API which does not<br /> have the deadlock problem as configfs_register_group() and does not require<br /> the delayed work handler.<br /> <br /> [mani: slightly reworded the description and added stable list]