The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV Before disabling SR-IOV via config     space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs. Since     commit 9d16947b7583 (PCI: Add global pci_lock_rescan_remove()) such removal operations are serialized     against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in     sriov_disable() however. In particular when commit 18f9e9d150fc (PCI/IOV: Factor out sriov_add_vfs())     factored out the PCI device removal into sriov_del_vfs() there was still no locking around the     pci_iov_remove_virtfn() calls. On s390 the lack of serialization in sriov_disable() may cause double     remove and list corruption with the below (amended) trace being observed: PSW: 0704c00180000000     0000000c914e4b38 (klist_put+56) GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001     00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000     0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8 #0     [3800313fb20] device_del at c9158ad5c #1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0]     pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60]     zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6     [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8     [3800313fe10] kthread at c90feb390 #9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98]     ret_from_fork at c9194f3f2. This is because in addition to sriov_disable() removing the VFs, the platform     also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events     generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes     pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization     makes this checking racy. Other races may also be possible of course though given that this lack of     locking persisted so long observable races seem very rare. Even on s390 the list corruption was only     observed with certain devices since the platform events are only triggered by config accesses after the     removal, so as long as the removal finished synchronously they would not race. Either way the locking is     missing so fix this by adding it to the sriov_del_vfs() helper. Just like PCI rescan-remove, locking is     also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is     called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices     and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking. (CVE-2025-40219)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40219

medium Nessus Plugin ID 277481

Version 1.6