CVE-2025-38625

vfio/pds: Fix missing detach_ioas op

Description

In the Linux kernel, the following vulnerability has been resolved: vfio/pds: Fix missing detach_ioas op When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, the following WARN_ON() trace is seen and probe fails: WARNING: CPU: 0 PID: 5040 at drivers/vfio/vfio_main.c:317 __vfio_register_dev+0x130/0x140 [vfio] <...> pds_vfio_pci 0000:08:00.1: probe with driver pds_vfio_pci failed with error -22 This is because the driver's vfio_device_ops.detach_ioas isn't set. Fix this by using the generic vfio_iommufd_physical_detach_ioas function.

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/7dbfae90c5a33f6b694e7068bc9522cc2655373d
https://git.kernel.org/stable/c/1df8150ab4cc422bddfbd312d6758c50b688a971
https://git.kernel.org/stable/c/b265dff9fcf047f660976a5c92c83e7c414a2d95
https://git.kernel.org/stable/c/88b962fbd0ac30a65d2869c68d2f145be46ebe4d
https://git.kernel.org/stable/c/fe24d5bc635e103a517ec201c3cb571eeab8be2f

Frequently Asked Questions

What is the severity of CVE-2025-38625?: CVE-2025-38625 has not yet been assigned a CVSS score.
How to fix CVE-2025-38625?: To fix CVE-2025-38625, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-38625 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-38625 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-38625?: CVE-2025-38625 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.