deadlock potential with VT-d and legacy PCI device pass-through

published 2025-07-17 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21765

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock.

Patch / fix

distros 4 links 2

debian suse opensuse alpine

xen Debian 12 4.17.5+72-g01140da4e8-1
xen Debian 14, Debian 13 4.20.0-1

debian advisories DEBIAN-CVE-2025-1713

xen SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +5 more 4.16.7_02-150400.4.72.1
xen SLE Micro 5.5 4.17.5_08-150500.3.45.1
xen SLE Micro 5.2, SLE Micro 5.1 4.14.6_24-150300.3.87.1
xen SLE Module for Server Applications 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 4.18.4_06-150600.3.20.1
xen SLES LTSS Extended Security 12 SP5 4.12.4_60-3.127.1

suse advisories SUSE-SU-2025:02326-1 SUSE-SU-2025:02290-1 SUSE-SU-2025:01860-1 SUSE-SU-2025:01850-1 SUSE-SU-2025:1162-1

xen openSUSE Tumbleweed 4.20.0_08-4.1

opensuse advisories openSUSE-SU-2025:14860-1

xen Alpine 3.18 4.17.5-r3
xen Alpine 3.20, Alpine 3.19 4.18.4-r1
xen Alpine 3.21 4.19.2-r0
xen Alpine 3.24, Alpine 3.23, Alpine 3.22 4.19.1-r1

alpine advisories ALPINE-CVE-2025-1713

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

xenbits.xenproject.org/xsa/advisory-467.html advisory
xenbits.xen.org/xsa/advisory-467.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-1713 updated 2025-11-21 cvss 6.5

xen: Deadlock Potential with VT-d and Legacy PCI Device Pass-Through

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 15 mo ago (2025-07-17)

Exploit prediction

0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Xen Xen

Classification

Weakness

CWE-833 Deadlock

References

xenbits.xenproject.org /xsa/advisory-467.html
patch, vendor-advisory
xenbits.xen.org /xsa/advisory-467.html
patch, vendor-advisory
openwall.com /lists/oss-security/2025/02/27/1
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2025/02/27/3
mailing-list, third-party-advisory
openwall.com /lists/oss-security/2025/02/28/1
mailing-list, third-party-advisory

Sources

CVE List CVE-2025-1713
NVD CVE-2025-1713

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary