Acknowledged
Created: Aug 24, 2025
Updated: Aug 26, 2025
Found In Version: 10.23.30.1
Severity: Standard
Applicable for: Wind River Linux LTS 23
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]PCI: pnv_php: Clean up allocated IRQs on unplug[EOL][EOL]When the root of a nested PCIe bridge configuration is unplugged, the[EOL]pnv_php driver leaked the allocated IRQ resources for the child bridges'[EOL]hotplug event notifications, resulting in a panic.[EOL][EOL]Fix this by walking all child buses and deallocating all its IRQ resources[EOL]before calling pci_hp_remove_devices().[EOL][EOL]Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so[EOL]that it is only destroyed in pnv_php_free_slot(), instead of[EOL]pnv_php_disable_irq(). This is required since pnv_php_disable_irq() will[EOL]now be called by workers triggered by hot unplug interrupts, so the[EOL]workqueue needs to stay allocated.[EOL][EOL]The abridged kernel panic that occurs without this patch is as follows:[EOL][EOL] WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c[EOL] CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2[EOL] Call Trace:[EOL] msi_device_data_release+0x34/0x9c (unreliable)[EOL] release_nodes+0x64/0x13c[EOL] devres_release_all+0xc0/0x140[EOL] device_del+0x2d4/0x46c[EOL] pci_destroy_dev+0x5c/0x194[EOL] pci_hp_remove_devices+0x90/0x128[EOL] pci_hp_remove_devices+0x44/0x128[EOL] pnv_php_disable_slot+0x54/0xd4[EOL] power_write_file+0xf8/0x18c[EOL] pci_slot_attr_store+0x40/0x5c[EOL] sysfs_kf_write+0x64/0x78[EOL] kernfs_fop_write_iter+0x1b0/0x290[EOL] vfs_write+0x3bc/0x50c[EOL] ksys_write+0x84/0x140[EOL] system_call_exception+0x124/0x230[EOL] system_call_vectored_common+0x15c/0x2ec[EOL][EOL][bhelgaas: tidy comments]
CREATE(Triage):(User=pbi-cn) [CVE-2025-38624 (https://nvd.nist.gov/vuln/detail/CVE-2025-38624)