CVE-2025-40076

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()

Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because the object of type struct irq_domain_info passed to:

msi_create_parent_irq_domain() -> irq_domain_instantiate()() -> __irq_domain_instantiate()

has no reference to the parent IRQ domain. Using msi->domain->parent as an argument for generic_handle_domain_irq() leads to below error:

"Unable to handle kernel NULL pointer dereference at virtual address"

This error was identified while switching the upcoming RZ/G3S PCIe host controller driver to msi_create_parent_irq_domain() (which was using a similar pattern to handle MSIs (see link section)), but it was not tested on hardware using the pcie-rcar-host controller driver due to lack of hardware.

[mani: reworded subject and description]

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
LinuxLinux>= dd26c1a23fd5a607c50738ea0dcb6cdbb8185cfe, < e8e21aaf5d34015901cd271053a67a62b4204526; >= dd26c1a23fd5a607c50738ea0dcb6cdbb8185cfe, < d3fee10e40a938331e2aae34348691136db31304
LinuxLinux6.17

References

Timeline

Published
Oct 28, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-40077In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid overflow while left shift operation Should cast typCVE-2025-40078In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernCVE-2025-400797.8In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Sign extend struct ops return values properly The ns_bpf_qCVE-2025-40088.8The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge syCVE-2025-40080In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuseCVE-2025-400817.8In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsCVE-2025-400827.1In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() BUG: KASAN: CVE-2025-40083In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix null-deref in agg_dequeue To prevent a potentiCVE-2025-400847.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: transport_ipc: validate payload size before reading handle handCVE-2025-40085In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card InCVE-2025-40086In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds AnCVE-2025-400877.5In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a
CVE-2025-40076: Unscored | Vulnix