High 7.8Published Sep 11, 2025

CVE-2025-39783PCI: endpoint: Fix configfs group list head handling

Updated under an hour ago (Oct 27, 2026, 4:23 AM ET)

Does this affect you?

It affects Linux and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs().

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ef1433f717a2c63747a519d86965d73ff9bd08b3 before 80ea6e6904fb2ba4ccb5d909579988466ec65358; from ef1433f717a2c63747a519d86965d73ff9bd08b3 before d5aecddc3452371d9da82cdbb0c715812524b54b; from ef1433f717a2c63747a519d86965d73ff9bd08b3 before dc4ffbd571716ff3b171418fb03abe80e720a7b1; from ef1433f717a2c63747a519d86965d73ff9bd08b3 before 409af8b9f7b4f23cd0464e71c6cd6fe13c076ae2; from ef1433f717a2c63747a519d86965d73ff9bd08b3 before 0758862386f114d9ab1e23181461bd1e2e9ec4c6; from ef1433f717a2c63747a519d86965d73ff9bd08b3 before 6cf65505523224cab1449d726d2ce8180c2941ee; from ef1433f717a2c63747a519d86965d73ff9bd08b3 before a302bd89db35d8b7e279de4d2b41c16c7f191069; from ef1433f717a2c63747a519d86965d73ff9bd08b3 before d79123d79a8154b4318529b7b2ff7e15806f480b	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.18 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/80ea6e6904fb2ba4ccb5d909579988466ec65358	patch
https://git.kernel.org/stable/c/d5aecddc3452371d9da82cdbb0c715812524b54b	patch
https://git.kernel.org/stable/c/dc4ffbd571716ff3b171418fb03abe80e720a7b1	patch
https://git.kernel.org/stable/c/409af8b9f7b4f23cd0464e71c6cd6fe13c076ae2	patch
https://git.kernel.org/stable/c/0758862386f114d9ab1e23181461bd1e2e9ec4c6	patch
https://git.kernel.org/stable/c/6cf65505523224cab1449d726d2ce8180c2941ee	patch
https://git.kernel.org/stable/c/a302bd89db35d8b7e279de4d2b41c16c7f191069	patch
https://git.kernel.org/stable/c/d79123d79a8154b4318529b7b2ff7e15806f480b	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.