---
id: CVE-2025-38624
title: 'PCI: pnv_php: Clean up allocated IRQs on unplug'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  PCI: pnv_php: Clean up allocated IRQs on unplug

  When the root of a nested PCIe bridge configuration is unplugged, the
  pnv_php driver leaked the allocated IRQ resources…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    8c1ad4af160691e157d688ad9619ced2df556aac
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    912e200240b6f9758f0b126e64a61c9227f4ad37
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    398170b7fd0e0db2f8096df5206c75e5ff41415a
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    32173edf3fe2d447e14e5e3b299387c6f9602a88
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    28aa3cfce12487614219e7667ec84424e1f43227
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    1773c19fa55e944cdd2634e2d9e552f87f2d38d5
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    bbd302c4b79df10197ffa7270ca3aa572eeca33c
  - >-
    Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 <
    4668619092554e1b95c9a5ac2941ca47ba6d548a
  - Linux 4.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:05:21.395368Z'
published: '2025-08-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:49.500Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38624'
references:
  - url: 'https://git.kernel.org/stable/c/8c1ad4af160691e157d688ad9619ced2df556aac'
  - url: 'https://git.kernel.org/stable/c/912e200240b6f9758f0b126e64a61c9227f4ad37'
  - url: 'https://git.kernel.org/stable/c/398170b7fd0e0db2f8096df5206c75e5ff41415a'
  - url: 'https://git.kernel.org/stable/c/32173edf3fe2d447e14e5e3b299387c6f9602a88'
  - url: 'https://git.kernel.org/stable/c/28aa3cfce12487614219e7667ec84424e1f43227'
  - url: 'https://git.kernel.org/stable/c/1773c19fa55e944cdd2634e2d9e552f87f2d38d5'
  - url: 'https://git.kernel.org/stable/c/bbd302c4b79df10197ffa7270ca3aa572eeca33c'
  - url: 'https://git.kernel.org/stable/c/4668619092554e1b95c9a5ac2941ca47ba6d548a'
tags:
  - cve.org
epss: 0.0017
epssPercentile: 0.06406
ingestedAt: '2026-11-05T22:38:32.000Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

PCI: pnv_php: Clean up allocated IRQs on unplug

When the root of a nested PCIe bridge configuration is unplugged, the
pnv_php driver leaked the allocated IRQ resources for the child bridges'
hotplug event notifications, resulting in a panic.

Fix this by walking all child buses and deallocating all its IRQ resources
before calling pci_hp_remove_devices().

Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so
that it is only destroyed in pnv_php_free_slot(), instead of
pnv_php_disable_irq(). This is required since pnv_php_disable_irq() will
now be called by workers triggered by hot unplug interrupts, so the
workqueue needs to stay allocated.

The abridged kernel panic that occurs without this patch is as follows:

  WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c
  CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2
  Call Trace:
   msi_device_data_release+0x34/0x9c (unreliable)
   release_nodes+0x64/0x13c
   devres_release_all+0xc0/0x140
   device_del+0x2d4/0x46c
   pci_destroy_dev+0x5c/0x194
   pci_hp_remove_devices+0x90/0x128
   pci_hp_remove_devices+0x44/0x128
   pnv_php_disable_slot+0x54/0xd4
   power_write_file+0xf8/0x18c
   pci_slot_attr_store+0x40/0x5c
   sysfs_kf_write+0x64/0x78
   kernfs_fop_write_iter+0x1b0/0x290
   vfs_write+0x3bc/0x50c
   ksys_write+0x84/0x140
   system_call_exception+0x124/0x230
   system_call_vectored_common+0x15c/0x2ec

[bhelgaas: tidy comments]

## Affected

- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 8c1ad4af160691e157d688ad9619ced2df556aac`
- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 912e200240b6f9758f0b126e64a61c9227f4ad37`
- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 398170b7fd0e0db2f8096df5206c75e5ff41415a`
- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 32173edf3fe2d447e14e5e3b299387c6f9602a88`
- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 28aa3cfce12487614219e7667ec84424e1f43227`
- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 1773c19fa55e944cdd2634e2d9e552f87f2d38d5`
- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < bbd302c4b79df10197ffa7270ca3aa572eeca33c`
- `Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 4668619092554e1b95c9a5ac2941ca47ba6d548a`
- `Linux 4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.