CVE-2025-40145: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure
In the Linux kernel, the following vulnerability has been resolved:
PCI/pwrctrl: Fix double cleanup on devmaddactionorreset() failure
When devmaddactionorreset() fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup.
Replace the "goto errregulatorfree" by the actual freeing, as there will never be a need again for a second user of this label.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel PCI/pwrctrl code, replace the `goto err_regulator_free` path with the actual freeing operation, and ensure the caller does not repeat cleanup after `devm_add_action_or_reset()` fails because that function already invokes the cleanup callback.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40145?
CVE-2025-40145 is classified as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2025-40145?
To fix CVE-2025-40145, update your Linux kernel to the latest version that includes the patch addressing this vulnerability.
What systems are affected by CVE-2025-40145?
CVE-2025-40145 affects the Linux kernel and all systems running a vulnerable version.
What is the impact of CVE-2025-40145?
The impact of CVE-2025-40145 is primarily related to potential resource mismanagement during error handling in the PCI subsystem.
Is there a workaround for CVE-2025-40145?
There is no specific workaround for CVE-2025-40145; applying updates is recommended to mitigate the vulnerability.