{"cve":"CVE-2025-40076","nvd":{"published":"2025-10-28T12:15:42.160","modified":"2026-10-19T21:10:00.160","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()\n\nStarting with commit dd26c1a23fd5 (\"PCI: rcar-host: Switch to\nmsi_create_parent_irq_domain()\"), the MSI parent IRQ domain is NULL because\nthe object of type struct irq_domain_info passed to:\n\nmsi_create_parent_irq_domain() ->\n  irq_domain_instantiate()() ->\n    __irq_domain_instantiate()\n\nhas no reference to the parent IRQ domain. Using msi->domain->parent as an\nargument for generic_handle_domain_irq() leads to below error:\n\n\t\"Unable to handle kernel NULL pointer dereference at virtual address\"\n\nThis error was identified while switching the upcoming RZ/G3S PCIe host\ncontroller driver to msi_create_parent_irq_domain() (which was using a\nsimilar pattern to handle MSIs (see link section)), but it was not tested\non hardware using the pcie-rcar-host controller driver due to lack of\nhardware.\n\n[mani: reworded subject and description]","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/d3fee10e40a938331e2aae34348691136db31304","https://git.kernel.org/stable/c/e8e21aaf5d34015901cd271053a67a62b4204526"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2025-40076","score":0.00184,"percentile":0.07953,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}