CVE-2025-38624: PCI: pnv_php: Clean up allocated IRQs on unplug
In the Linux kernel, the following vulnerability has been resolved:
PCI: pnvphp: Clean up allocated IRQs on unplug
When the root of a nested PCIe bridge configuration is unplugged, the pnvphp driver leaked the allocated IRQ resources for the child bridges' hotplug event notifications, resulting in a panic.
Fix this by walking all child buses and deallocating all its IRQ resources before calling pcihpremovedevices().
Also modify the lifetime of the workqueue at struct pnvphpslot::wq so that it is only destroyed in pnvphpfreeslot(), instead of pnvphpdisableirq(). This is required since pnvphpdisableirq() will now be called by workers triggered by hot unplug interrupts, so the workqueue needs to stay allocated.
The abridged kernel panic that occurs without this patch is as follows:
WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msidevicedatarelease+0x6c/0x9c CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2 Call Trace: msidevicedatarelease+0x34/0x9c (unreliable) releasenodes+0x64/0x13c devresreleaseall+0xc0/0x140 devicedel+0x2d4/0x46c pcidestroydev+0x5c/0x194 pcihpremovedevices+0x90/0x128 pcihpremovedevices+0x44/0x128 pnvphpdisableslot+0x54/0xd4 powerwritefile+0xf8/0x18c pcislotattrstore+0x40/0x5c sysfskfwrite+0x64/0x78 kernfsfopwriteiter+0x1b0/0x290 vfswrite+0x3bc/0x50c ksyswrite+0x84/0x140 systemcallexception+0x124/0x230 systemcallvectoredcommon+0x15c/0x2ec
[bhelgaas: tidy comments]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38624?
CVE-2025-38624 has a medium severity rating due to potential resource leaks affecting system stability.
How do I fix CVE-2025-38624?
To fix CVE-2025-38624, update the Linux kernel to the latest version where this vulnerability has been patched.
Which systems are affected by CVE-2025-38624?
CVE-2025-38624 affects the Linux kernel, particularly systems using the pnv_php driver for nested PCIe bridges.
What impact does CVE-2025-38624 have on system performance?
CVE-2025-38624 can lead to performance degradation as it may cause resource leakage upon unplugging PCIe components.
Is there a workaround for CVE-2025-38624?
Currently, there is no documented workaround for CVE-2025-38624 other than applying the kernel update.