1. Home
  2. Vulnerabilities
  3. CVE-2025-23140
5.5
MEDIUM CVSS 3.1
CVE-2025-23140
misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
Description

In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released. However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message: remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq(). [kwilczynski: commit log]

INFO

Published Date :

May 1, 2025, 1:15 p.m.

Last Modified :

Nov. 5, 2025, 9:46 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2025-23140 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
1 Debian debian_linux
: Total Affected Vendor : 2 | Products : 2
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 MEDIUM [email protected]
Solution
Update the Linux kernel to resolve an interrupt handling issue in the PCI endpoint test module.
  • Apply the provided kernel patch.
  • Recompile the kernel.
  • Install the updated kernel.
  • Reboot the system.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-23140.

URL Resource
https://git.kernel.org/stable/c/0557e70e2aeba8647bf5a950820b67cfb86533db Patch
https://git.kernel.org/stable/c/54c9f299ad7d7c4be5d271ed12d01a59e95b8907 Patch
https://git.kernel.org/stable/c/5a4b7181213268c9b07bef8800905528435db44a Patch
https://git.kernel.org/stable/c/705be96504779e4a333ea042b4779ea941f0ace9 Patch
https://git.kernel.org/stable/c/770407f6173f4f39f4e2c1b54422b79ce6c98bdb Patch
https://git.kernel.org/stable/c/9d5118b107b1a2353ed0dff24404aee2e6b7ca0a Patch
https://git.kernel.org/stable/c/e516e187bf32d8decc7c7d0025ae4857cad13c0e Patch
https://git.kernel.org/stable/c/f6cb7828c8e17520d4f5afb416515d3fae1af9a9 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Mailing List Third Party Advisory
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-23140 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-23140 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-23140 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-23140 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Nov. 05, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    Added CWE NVD-CWE-noinfo
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.88 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.181 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.237 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.135 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.25 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19 up to (excluding) 5.4.293 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.14.3
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/0557e70e2aeba8647bf5a950820b67cfb86533db Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/54c9f299ad7d7c4be5d271ed12d01a59e95b8907 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/5a4b7181213268c9b07bef8800905528435db44a Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/705be96504779e4a333ea042b4779ea941f0ace9 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/770407f6173f4f39f4e2c1b54422b79ce6c98bdb Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/9d5118b107b1a2353ed0dff24404aee2e6b7ca0a Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/e516e187bf32d8decc7c7d0025ae4857cad13c0e Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/f6cb7828c8e17520d4f5afb416515d3fae1af9a9 Types: Patch
    Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Types: Mailing List, Third Party Advisory
    Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Types: Mailing List, Third Party Advisory
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 03, 2025

    Action Type Old Value New Value
    Added Reference https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
    Added Reference https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    May. 02, 2025

    Action Type Old Value New Value
    Added Reference https://git.kernel.org/stable/c/54c9f299ad7d7c4be5d271ed12d01a59e95b8907
    Added Reference https://git.kernel.org/stable/c/705be96504779e4a333ea042b4779ea941f0ace9
    Added Reference https://git.kernel.org/stable/c/e516e187bf32d8decc7c7d0025ae4857cad13c0e
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    May. 01, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released. However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message: remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq(). [kwilczynski: commit log]
    Added Reference https://git.kernel.org/stable/c/0557e70e2aeba8647bf5a950820b67cfb86533db
    Added Reference https://git.kernel.org/stable/c/5a4b7181213268c9b07bef8800905528435db44a
    Added Reference https://git.kernel.org/stable/c/770407f6173f4f39f4e2c1b54422b79ce6c98bdb
    Added Reference https://git.kernel.org/stable/c/9d5118b107b1a2353ed0dff24404aee2e6b7ca0a
    Added Reference https://git.kernel.org/stable/c/f6cb7828c8e17520d4f5afb416515d3fae1af9a9
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 5.5
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact