#VU119816 Insufficient technical documentation in PCI Express (PCIe) Base Specification - CVE-2025-9613
Published: December 10, 2025
Vulnerability identifier: #VU119816
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-9613
CWE-ID: CWE-1059
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
PCI Express (PCIe) Base Specification
PCI Express (PCIe) Base Specification
Software vendor:
PCI-SIG
PCI-SIG
Description
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to insufficient guidance on tag reuse after completion timeouts described in PCI Express (PCIe) Base Specification. If the IDE-protected request’s tag is released due to a completion timeout, a subsequent IDE request may reuse the same tag. If the delayed completion of the original request arrives after the new request, the receiver may consume stale or incorrect data. A local user can violate integrity and confidentiality objectives of IDE and TDISP.
Remediation
The PCI-SIG has issued a Draft Engineering Change Notice (D-ECN) titled “IDE TLP Reordering Enhancement” to the Base Specification Rev 7.0. The D-ECN feature will be included in upcoming PCI specifications (Base 6.5 and 7.1) and can also be used in current Base 5.x systems through standard compliance procedures.