CVE-2025-39783

What it actually does

Incorrect list_del() on a list head (epf_group field) in pci_epf_remove_cfs() triggers slab-use-after-free when tearing down a PCI endpoint function driver that registers a configfs attribute group.

Why it matters to the business

Local memory corruption on Linux systems exposing PCI endpoint functionality can lead to crashes or potential privilege escalation during driver unload; high prevalence in kernel distributions increases patching urgency despite low EPSS.

How an attack unfolds

An attacker with local access unloads or triggers removal of an affected PCI endpoint function driver (e.g., via rmmod of nvmet_pci_epf or similar), causing the erroneous list_del to corrupt kernel slab memory and enabling further exploitation such as arbitrary write.

How to fix it

Update the Linux kernel to a version containing commit 80ea6e6904fb2ba4ccb5d909579988466ec65358 or later; rebuild and deploy fixed packages for affected distributions (e.g., grafana-12.1 12.1.0-r2).

How to confirm the fix worked

Confirm the patch by inspecting pci_epf_remove_cfs() for removal of the list_del call on epf_group; verify no KASAN reports on driver unload and check kernel version against fixed commits.

Typical attack path

1. Obtain local access or ability to load/unload kernel modules
2. Trigger pci_epf_unregister_driver or equivalent cleanup path for a configfs-enabled endpoint driver
3. Execute the buggy pci_epf_remove_cfs list operation
4. Exploit resulting use-after-free for code execution or denial of service

How to detect it

Review kernel logs for KASAN slab-use-after-free reports mentioning pci_epf_remove_cfs during rmmod or module unload; correlate with PCI endpoint function driver activity.

What your security team should do

• Prioritize kernel updates on systems using PCI endpoint/configfs drivers within 30 days
• Monitor for local module unload events on endpoints
• Test driver removal paths in staging environments before production rollout