{"id":"CVE-2025-40117","state":"PUBLISHED","title":"misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()\n\nCommit eefb83790a0d (\"misc: pci_endpoint_test: Add doorbell test case\")\nadded NO_BAR (-1) to the pci_barno enum which, in practical terms,\nchanges the enum from an unsigned int to a signed int.  If the user\npasses a negative number in pci_endpoint_test_ioctl() then it results in\nan array underflow in pci_endpoint_test_bar().","publishedAt":"2025-11-12T10:23:17.851Z","updatedAt":"2026-08-05T12:07:53.958Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"eefb83790a0dda112d1755e4f5e213738d717e76","status":"affected","lessThan":"6df3687922570f753574c40b35e83b26b32292d0","versionType":"git"},{"version":"eefb83790a0dda112d1755e4f5e213738d717e76","status":"affected","lessThan":"1ad82f9db13d85667366044acdfb02009d576c5a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/misc/pci_endpoint_test.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.17.3","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/misc/pci_endpoint_test.c"]}],"references":["https://git.kernel.org/stable/c/6df3687922570f753574c40b35e83b26b32292d0","https://git.kernel.org/stable/c/1ad82f9db13d85667366044acdfb02009d576c5a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40117.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40117","state":"PUBLISHED","datePublished":"2025-11-12T10:23:17.851Z","dateUpdated":"2026-08-05T12:07:53.958Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.168Z"},"containers":{"cna":{"title":"misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()\n\nCommit eefb83790a0d (\"misc: pci_endpoint_test: Add doorbell test case\")\nadded NO_BAR (-1) to the pci_barno enum which, in practical terms,\nchanges the enum from an unsigned int to a signed int.  If the user\npasses a negative number in pci_endpoint_test_ioctl() then it results in\nan array underflow in pci_endpoint_test_bar()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"eefb83790a0dda112d1755e4f5e213738d717e76","status":"affected","lessThan":"6df3687922570f753574c40b35e83b26b32292d0","versionType":"git"},{"version":"eefb83790a0dda112d1755e4f5e213738d717e76","status":"affected","lessThan":"1ad82f9db13d85667366044acdfb02009d576c5a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/misc/pci_endpoint_test.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.17.3","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/misc/pci_endpoint_test.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6df3687922570f753574c40b35e83b26b32292d0"},{"url":"https://git.kernel.org/stable/c/1ad82f9db13d85667366044acdfb02009d576c5a"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is triggered by a PCITEST_BAR ioctl on the local misc device /dev/pci-endpoint-test.N, requiring local system access rather than any network or physical interaction.\nAC:L - A single ioctl with any negative argument deterministically defeats the signed `bar > BAR_5` check; there is no race, no timing window, and no dependence on state outside the attacker's control.\nPR:L - The driver performs no capability check at all — no CAP_SYS_ADMIN, no .open hook, nothing — so any local user holding a descriptor to the test device node can trigger it, and on the PCI-endpoint test rigs where this driver is deployed the node is commonly exposed to the non-root test-automation account.\nUI:N - The attacker performs the entire attack via its own ioctl call; no victim action or cooperation is needed.\nS:U - The out-of-bounds accesses corrupt kernel memory and MMIO mappings within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The attacker-controlled negative index produces out-of-bounds reads of `pdev->resource[]`, of `struct pci_endpoint_test`, of `.rodata`, and a `memcpy_fromio()` of up to 1 MB from an OOB-derived pointer, and the resulting memory-corruption primitive can be leveraged for arbitrary kernel memory disclosure.\nI:H - `memcpy_toio(test->bar[barno] + offset, ...)` writes megabytes of pattern data to a destination pointer read from out-of-bounds memory at an attacker-chosen index, clobbering kernel heap objects (including `struct pci_dev`) or adjacent device MMIO registers — an arbitrary-write primitive exploitable for control-flow hijacking.\nA:H - The loop bound comes from a garbage `bar_size` read out of bounds, so the write runs far past any valid mapping and reliably faults, and the heap corruption itself guarantees a kernel oops or panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:07:53.958Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.17.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}