CVE-2025-39784
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix link speed calculation on retrain failure When pcie_failed_link_retrain() fails to retrain, it tries to revert to the previous link speed. However it calculates that speed from the Link Control 2 register without masking out non-speed bits first. PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in pcie_set_target_speed(): pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s pci 0000:00:01.1: retraining failed WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000 pcie_failed_link_retrain pci_device_add pci_scan_single_device Mask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN. [bhelgaas: commit log, add details from https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de]
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-11 17:15:44.493000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-39784",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-11T17:15:44.493",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix link speed calculation on retrain failure\n\nWhen pcie_failed_link_retrain() fails to retrain, it tries to revert to the\nprevious link speed. However it calculates that speed from the Link\nControl 2 register without masking out non-speed bits first.\n\nPCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to\nPCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in\npcie_set_target_speed():\n\n pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port\n pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s\n pci 0000:00:01.1: retraining failed\n WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed\n RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000\n pcie_failed_link_retrain\n pci_device_add\n pci_scan_single_device\n\nMask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and\nPCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN.\n\n[bhelgaas: commit log, add details from https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de]"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPCI: Corrección del cálculo de la velocidad del enlace en caso de fallo de reentrenamiento\n\nCuando pcie_failed_link_retrain() falla al reentrenar, intenta revertir a la velocidad de enlace anterior. Sin embargo, calcula esa velocidad desde el registro Link Control 2 sin enmascarar primero los bits que no son de velocidad.\n\nPCIE_LNKCTL2_TLS2SPEED() convierte dichos valores incorrectos a PCI_SPEED_UNKNOWN (0xff), lo que a su vez provoca un WARN splat en pcie_set_target_speed():\n\n pci 0000:00:01.1: [1022:14ed] tipo 01 clase 0x060400 Puerto raíz PCIe\n pci 0000:00:01.1: dispositivo roto, reentrenando enlace descendente no funcional a 2.5GT/s\n pci 0000:00:01.1: reentrenamiento fallido\n WARNING: CPU: 1 PID: 1 en drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed\n RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000\n pcie_failed_link_retrain\n pci_device_add\n pci_scan_single_device\n\nEnmascarar los bits que no son de velocidad en PCIE_LNKCTL2_TLS2SPEED() y PCIE_LNKCAP_SLS2SPEED() para que no devuelvan incorrectamente PCI_SPEED_UNKNOWN.\n\n[bhelgaas: registro de commit, añadir detalles de https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de]"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/pci/pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "de9a6c8d5dbfedb5eb3722c822da0490f6a59a45",
"lessThan": "16557320f378262b5c605b15edebd3642406992a",
"versionType": "git",
"status": "affected"
},
{
"version": "de9a6c8d5dbfedb5eb3722c822da0490f6a59a45",
"lessThan": "9989e0ca7462c62f93dbc62f684448aa2efb9226",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/pci/pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.13",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.13",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.4",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.16.4",
"matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/16557320f378262b5c605b15edebd3642406992a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9989e0ca7462c62f93dbc62f684448aa2efb9226",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}