In the Linux kernel, the following vulnerability has been resolved:
s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs
With commit bcb5d6c76903 ("s390/pci: introduce lock to synchronize state
of zpci_dev's") the code to ignore power off of a PF that has child VFs
was changed from a direct return to a goto to the unlock and
pci_dev_put() section. The change however left the existing pci_dev_put()
untouched resulting in a doubple put. This can subsequently cause a use
after free if the struct pci_dev is released in an unexpected state.
Fix this by removing the extra pci_dev_put().
References
Configurations
Configuration 1 (hide)
|
History
17 Nov 2025, 12:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/05a2538f2b48500cf4e8a0a0ce76623cc5bafcf1 - Patch | |
| References | () https://git.kernel.org/stable/c/957529baef142d95e0d1b1bea786675bd47dbe53 - Patch | |
| References | () https://git.kernel.org/stable/c/c488f8b53e156d6dcc0514ef0afa3a33376b8f9e - Patch | |
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* |
Information
Published : 2025-05-20 16:15
Updated : 2025-11-17 12:57
NVD link : CVE-2025-37946
Mitre link : CVE-2025-37946
CVE.ORG link : CVE-2025-37946
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free