Linux kernel PCI endpoint NULL deref after alloc_workqueue()
CVE-2025-71313 Published on June 3, 2026
PCI: endpoint: Add missing NULL check for alloc_workqueue()
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Add missing NULL check for alloc_workqueue()
alloc_workqueue() can return NULL on memory allocation failure. Without
proper error checking, this may lead to a NULL pointer dereference when
queue_work() is later called with the NULL workqueue pointer in
epf_ntb_epc_init().
Add a NULL check immediately after alloc_workqueue() and return -ENOMEM on
failure to prevent the driver from loading with an invalid workqueue
pointer.
Products Associated with CVE-2025-71313
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 8b821cf761503b80d0bd052f932adfe1bc1a0088 and below 314eab6740bcda504ef978be599f805de05ce6de is affected.
- Version 8b821cf761503b80d0bd052f932adfe1bc1a0088 and below 03f336a869b3a3f119d3ae52ac9723739c7fb7b6 is affected.
- Version 5.12 is affected.
- Before 5.12 is unaffected.
- Version 6.19.4, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.