CVE-2025-40219: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-p5jg-472w-q92f
Share
Published
Advisory Summary

CVE-2025-40219 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2025-40219 at a Glance

CVE Identifier CVE-2025-40219
GHSA Identifier GHSA-p5jg-472w-q92f
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2025-40219

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2025-40219, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV Before disabling SR-IOV via config space accesses to the parent PF, sriov_disable() first removes the PCI devices representing the VFs. Since commit 9d16947b7583 ("PCI: Add global pci_lock_rescan_remove()") such removal operations are serialized against concurrent remove and rescan using the pci_rescan_remove_lock. No such locking was ever added in sriov_disable() however. In particular when commit 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()") factored out the PCI device removal into sriov_del_vfs() there was still no locking around the pci_iov_remove_virtfn() calls. On s390 the lack of serialization in sriov_disable() may cause double remove and list corruption with the below (amended) trace being observed: PSW: 0704c00180000000 0000000c914e4b38 (klist_put+56) GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001 00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480 0000000000000001 0000000000000000 0000000000000000 0000000180692828 00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8 #0 [3800313fb20] device_del at c9158ad5c #1 [3800313fb88] pci_remove_bus_device at c915105ba #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198 #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0 #4 [3800313fc60] zpci_bus_remove_device at c90fb6104 #5 [3800313fca0] __zpci_event_availability at c90fb3dca #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2 #7 [3800313fd60] crw_collect_info at c91905822 #8 [3800313fe10] kthread at c90feb390 #9 [3800313fe68] __ret_from_fork at c90f6aa64 #10 [3800313fe98] ret_from_fork at c9194f3f2. This is because in addition to sriov_disable() removing the VFs, the platform also generates hot-unplug events for the VFs. This being the reverse operation to the hotplug events generated by sriov_enable() and handled via pdev->no_vf_scan. And while the event processing takes pci_rescan_remove_lock and checks whether the struct pci_dev still exists, the lack of synchronization makes this checking racy. Other races may also be possible of course though given that this lack of locking persisted so long observable races seem very rare. Even on s390 the list corruption was only observed with certain devices since the platform events are only triggered by config accesses after the removal, so as long as the removal finished synchronously they would not race. Either way the locking is missing so fix this by adding it to the sriov_del_vfs() helper. Just like PCI rescan-remove, locking is also missing in sriov_add_vfs() including for the error case where pci_stop_and_remove_bus_device() is called without the PCI rescan-remove lock being held. Even in the non-error case, adding new PCI devices and buses should be serialized via the PCI rescan-remove lock. Add the necessary locking.

References

NVD — CVE-2025-40219 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40219
git.kernel.org/stable/c/f3015627b6... WEB
https://git.kernel.org/stable/c/f3015627b6e9ddf85cfeaf42405b3c194dde2c36
git.kernel.org/stable/c/ee40e5db05... WEB
https://git.kernel.org/stable/c/ee40e5db052d7c6f406fdb95ad639c894c74674c
git.kernel.org/stable/c/d7673ac466... WEB
https://git.kernel.org/stable/c/d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b
git.kernel.org/stable/c/bea1d37309... WEB
https://git.kernel.org/stable/c/bea1d373098b22d7142da48750ce5526096425bc
git.kernel.org/stable/c/a645ca21de... WEB
https://git.kernel.org/stable/c/a645ca21de09e3137cbb224fa6c23cca873a1d01
git.kernel.org/stable/c/a5338e365c... WEB
https://git.kernel.org/stable/c/a5338e365c4559d7b4d7356116b0eb95b12e08d5
git.kernel.org/stable/c/a242191724... WEB
https://git.kernel.org/stable/c/a24219172456f035d886857e265ca24c85b167c8
git.kernel.org/stable/c/97c18f074f... WEB
https://git.kernel.org/stable/c/97c18f074ff1c12d016a0753072a3afdfa0b9611
git.kernel.org/stable/c/7c37920c96... WEB
https://git.kernel.org/stable/c/7c37920c96b85ef4255a7acc795e99e63dd38d59
git.kernel.org/stable/c/5c1cd7d405... WEB
https://git.kernel.org/stable/c/5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf
git.kernel.org/stable/c/53154cd40c... WEB
https://git.kernel.org/stable/c/53154cd40ccf285f1d1c24367824082061d155bd
git.kernel.org/stable/c/3cddde4844... WEB
https://git.kernel.org/stable/c/3cddde484471c602bea04e6f384819d336a1ff84
git.kernel.org/stable/c/36039348bc... WEB
https://git.kernel.org/stable/c/36039348bca77828bf06eae41b8f76e38cd15847
git.kernel.org/stable/c/1e8a80290f... WEB
https://git.kernel.org/stable/c/1e8a80290f964bdbad225221c8a1594c7e01c8fd
git.kernel.org/stable/c/1047ca2d81... WEB
https://git.kernel.org/stable/c/1047ca2d816994f31e1475e63e0c0b7825599747
git.kernel.org/stable/c/05703271c3... WEB
https://git.kernel.org/stable/c/05703271c3cdcc0f2a8cf6ebdc45892b8ca83520
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.com/productcert/html/ss... WEB
https://cert-portal.siemens.com/productcert/html/ssa-019113.html

Frequently Asked Questions

What is CVE-2025-40219?
CVE-2025-40219 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2025-40219?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2025-40219?
CVE-2025-40219 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2025-40219?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p5jg-472w-q92f",
  "modified" : "2026-10-15T03:34:59Z",
  "published" : "2025-12-04T15:30:33Z",
  "aliases" : [ "CVE-2025-40219" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\n\nBefore disabling SR-IOV via config space accesses to the parent PF,\nsriov_disable() first removes the PCI devices representing the VFs.\n\nSince commit 9d16947b7583 (\"PCI: Add global pci_lock_rescan_remove()\")\nsuch removal operations are serialized against concurrent remove and\nrescan using the pci_rescan_remove_lock. No such locking was ever added\nin sriov_disable() however. In particular when commit 18f9e9d150fc\n(\"PCI/IOV: Factor out sriov_add_vfs()\") factored out the PCI device\nremoval into sriov_del_vfs() there was still no locking around the\npci_iov_remove_virtfn() calls.\n\nOn s390 the lack of serialization in sriov_disable() may cause double\nremove and list corruption with the below (amended) trace being observed:\n\n  PSW:  0704c00180000000 0000000c914e4b38 (klist_put+56)\n  GPRS: 000003800313fb48 0000000000000000 0000000100000001 0000000000000001\n\t00000000f9b520a8 0000000000000000 0000000000002fbd 00000000f4cc9480\n\t0000000000000001 0000000000000000 0000000000000000 0000000180692828\n\t00000000818e8000 000003800313fe2c 000003800313fb20 000003800313fad8\n  #0 [3800313fb20] device_del at c9158ad5c\n  #1 [3800313fb88] pci_remove_bus_device at c915105ba\n  #2 [3800313fbd0] pci_iov_remove_virtfn at c9152f198\n  #3 [3800313fc28] zpci_iov_remove_virtfn at c90fb67c0\n  #4 [3800313fc60] zpci_bus_remove_device at c90fb6104\n  #5 [3800313fca0] __zpci_event_availability at c90fb3dca\n  #6 [3800313fd08] chsc_process_sei_nt0 at c918fe4a2\n  #7 [3800313fd60] crw_collect_info at c91905822\n  #8 [3800313fe10] kthread at c90feb390\n  #9 [3800313fe68] __ret_from_fork at c90f6aa64\n  #10 [3800313fe98] ret_from_fork at c9194f3f2.\n\nThis is because in addition to sriov_disable() removing the VFs, the\nplatform also generates hot-unplug events for the VFs. This being the\nreverse operation to the hotplug events generated by sriov_enable() and\nhandled via pdev->no_vf_scan. And while the event processing takes\npci_rescan_remove_lock and checks whether the struct pci_dev still exists,\nthe lack of synchronization makes this checking racy.\n\nOther races may also be possible of course though given that this lack of\nlocking persisted so long observable races seem very rare. Even on s390 the\nlist corruption was only observed with certain devices since the platform\nevents are only triggered by config accesses after the removal, so as long\nas the removal finished synchronously they would not race. Either way the\nlocking is missing so fix this by adding it to the sriov_del_vfs() helper.\n\nJust like PCI rescan-remove, locking is also missing in sriov_add_vfs()\nincluding for the error case where pci_stop_and_remove_bus_device() is\ncalled without the PCI rescan-remove lock being held. Even in the non-error\ncase, adding new PCI devices and buses should be serialized via the PCI\nrescan-remove lock. Add the necessary locking.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-40219"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f3015627b6e9ddf85cfeaf42405b3c194dde2c36"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ee40e5db052d7c6f406fdb95ad639c894c74674c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d7673ac466eca37ec3e6b7cc9ccdb06de3304e9b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bea1d373098b22d7142da48750ce5526096425bc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a645ca21de09e3137cbb224fa6c23cca873a1d01"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a5338e365c4559d7b4d7356116b0eb95b12e08d5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a24219172456f035d886857e265ca24c85b167c8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/97c18f074ff1c12d016a0753072a3afdfa0b9611"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7c37920c96b85ef4255a7acc795e99e63dd38d59"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/53154cd40ccf285f1d1c24367824082061d155bd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3cddde484471c602bea04e6f384819d336a1ff84"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/36039348bca77828bf06eae41b8f76e38cd15847"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1e8a80290f964bdbad225221c8a1594c7e01c8fd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1047ca2d816994f31e1475e63e0c0b7825599747"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/05703271c3cdcc0f2a8cf6ebdc45892b8ca83520"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
  }, {
    "type" : "WEB",
    "url" : "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2025-12-04T15:15:57Z"
  }
}