CVE-2025-38624

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: pnv_php: Clean up allocated IRQs on unplug

When the root of a nested PCIe bridge configuration is unplugged, the

pnv_php driver leaked the allocated IRQ resources for the child bridges'

hotplug event notifications, resulting in a panic.

Fix this by walking all child buses and deallocating all its IRQ resources

before calling pci_hp_remove_devices().

Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so

that it is only destroyed in pnv_php_free_slot(), instead of

pnv_php_disable_irq(). This is required since pnv_php_disable_irq() will

now be called by workers triggered by hot unplug interrupts, so the

workqueue needs to stay allocated.

The abridged kernel panic that occurs without this patch is as follows:

WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c

CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2

Call Trace:

msi_device_data_release

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References