CVE-2025-23140 Details
Description
In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error After devm_request_irq() fails with error in pci_endpoint_test_request_irq(), the pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs have been released. However, some requested IRQs remain unreleased, so there are still /proc/irq/* entries remaining, and this results in WARN() with the following message: remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0' WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c To solve this issue, set the number of remaining IRQs to test->num_irqs, and release IRQs in advance by calling pci_endpoint_test_release_irq(). [kwilczynski: commit log]
A vulnerability in the Linux kernel's PCI endpoint test module can lead to improper interrupt management. When the function 'devm_request_irq()' fails, the subsequent call to 'pci_endpoint_test_free_irq_vectors()' incorrectly assumes that all interrupts have been released. This oversight leaves some interrupts unacknowledged, causing residual entries in '/proc/irq/*' that trigger a warning about removing a non-empty directory, indicating a leak of IRQ information. The vulnerability arises from the failure to properly manage interrupt requests, which can lead to inconsistencies in the IRQ handling process.
The vulnerability has been addressed by modifying the interrupt handling process to correctly release IRQs before freeing them, ensuring that no residual entries are left in the IRQ management system. Users should apply the latest patches available in the Linux kernel to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0557e70e2aeba8647bf5a950820b67cfb86533db | kernel.org | Patch |
| https://git.kernel.org/stable/c/54c9f299ad7d7c4be5d271ed12d01a59e95b8907 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5a4b7181213268c9b07bef8800905528435db44a | kernel.org | Patch |
| https://git.kernel.org/stable/c/705be96504779e4a333ea042b4779ea941f0ace9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/770407f6173f4f39f4e2c1b54422b79ce6c98bdb | kernel.org | Patch |
| https://git.kernel.org/stable/c/9d5118b107b1a2353ed0dff24404aee2e6b7ca0a | kernel.org | Patch |
| https://git.kernel.org/stable/c/e516e187bf32d8decc7c7d0025ae4857cad13c0e | kernel.org | Patch |
| https://git.kernel.org/stable/c/f6cb7828c8e17520d4f5afb416515d3fae1af9a9 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html | CVE | Mailing ListThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.19, < 5.4.293 >= 5.5, < 5.10.237 >= 5.11, < 5.15.181 >= 5.16, < 6.1.135 >= 6.2, < 6.6.88 >= 6.7, < 6.12.25 >= 6.13, < 6.14.3 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 5, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| May 2, 2025 | CVE Modified | kernel.org |
| May 1, 2025 | New CVE Received | kernel.org |