CVE-2025-38624

A flaw was found in the pnv-php module in the Linux kernel. When the root of a nested PCIe bridge configuration is unplugged, the driver fails to properly clean up and deallocate the IRQ resources for the child bridges' hotplug event notifications, resulting in a kernel panic and denial of service.

On PowerNV, unplugging the root of a nested PCIe bridge tree leaked MSI/MSI-X resources for child bridges’ hotplug notifications, triggering a kernel panic during device removal. The patch walks downstream buses to free all IRQ resources before pci_hp_remove_devices(), and adjusts the workqueue lifetime so IRQ cleanup invoked from hot-unplug workers is safe. Impact is denial of service; exploitation typically requires privileged local control of PCI hotplug (hence PR:H, AV:L).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.