{
  "threat_severity" : "Moderate",
  "public_date" : "2025-10-28T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()",
    "id" : "2406782",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2406782"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.6",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-476",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nPCI/AER: Avoid NULL pointer dereference in aer_ratelimit()\nWhen platform firmware supplies error information to the OS, e.g., via the\nACPI APEI GHES mechanism, it may identify an error source device that\ndoesn't advertise an AER Capability and therefore dev->aer_info, which\ncontains AER stats and ratelimiting data, is NULL.\npci_dev_aer_stats_incr() already checks dev->aer_info for NULL, but\naer_ratelimit() did not, leading to NULL pointer dereferences like this one\nfrom the URL below:\n{1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 0\n{1}[Hardware Error]: event severity: corrected\n{1}[Hardware Error]:   device_id: 0000:00:00.0\n{1}[Hardware Error]:   vendor_id: 0x8086, device_id: 0x2020\n{1}[Hardware Error]:   aer_cor_status: 0x00001000, aer_cor_mask: 0x00002000\nBUG: kernel NULL pointer dereference, address: 0000000000000264\nRIP: 0010:___ratelimit+0xc/0x1b0\npci_print_aer+0x141/0x360\naer_recover_work_func+0xb5/0x130\n[8086:2020] is an Intel \"Sky Lake-E DMI3 Registers\" device that claims to\nbe a Root Port but does not advertise an AER Capability.\nAdd a NULL check in aer_ratelimit() to avoid the NULL pointer dereference.\nNote that this also prevents ratelimiting these events from GHES.\n[bhelgaas: add crash details to commit log]", "A flaw was found in the Linux kernel PCI/AER (Advanced Error Reporting) subsystem. When platform firmware reports error information via the ACPI APEI GHES mechanism for a device that does not advertise an AER capability, dev->aer_info remains NULL. The function aer_ratelimit() does not check for this condition, leading to a NULL pointer dereference." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-05-19T00:00:00Z",
    "advisory" : "RHSA-2026:18134",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.7.1.el10_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-40034\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40034\nhttps://lore.kernel.org/linux-cve-announce/2025102811-CVE-2025-40034-e836@gregkh/T" ],
  "name" : "CVE-2025-40034",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}