CVE-2025-9613
A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after completion timeouts may allow multiple outstanding Non-Posted Requests to share the same tag.
Does this matter?
Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after completion timeouts may allow multiple outstanding Non-Posted Requests to share the same tag. This tag aliasing condition can result in completions being delivered to the wrong security context, potentially compromising data integrity and confidentiality.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.21% probability · 12th percentile
- CISA KEV
- Not listed
- Affected
- pcisig/pci express integrity and data encryption
- Source
- cret@cert.org
References
- https://pcisig.com/PCIeIDEStandardVulnerabilitiesVendor Advisory
- https://pcisig.com/specificationsProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.