Linux kernel (drivers/pci/hotplug): The hotplug driver disables MSI/MSI-X during slot unregistration after the MSI data

Impact

The hotplug driver disables MSI/MSI-X during slot unregistration after the MSI data structure has already been freed and NULLed on the disable path. The NULL dereference crashes the host kernel, so hot-unplugging a PCIe switch or bridge takes the whole node down rather than removing one device.

Who can reach it

Triggered by disabling or hot-unplugging a PCIe switch/bridge from the host bridge - an operator sysfs action or a physical removal, neither requiring tenant privilege. PowerNV only (pnv_php on OpenPOWER); inert on x86 and ARM GPU nodes. Relevant only if IBM POWER hosts are in the fleet.

What to do

Update to a kernel carrying the fix (fixed_in lists only very old branches; use the stable commits below against your running branch). Interim on PowerNV: drain the node before removing bridges or switches.

References

Related entries

• Linux kernel (drivers/pci/hotplug): Removing nested PCIe hotplug ports can deadlock - a parent hotplug port holds theCVE-2025-37843 · Linux kernel (drivers/pci/hotplug)Medium
• Linux kernel (drivers/pci/hotplug): A surprise device removal freezes the PCI host bridge's partitionable endpoint andCVE-2025-38623 · Linux kernel (drivers/pci/hotplug)Medium
• Linux kernel (drivers/pci/hotplug): Unplugging the root of a nested PCIe bridge hierarchy leaks the IRQ resources theCVE-2025-38624 · Linux kernel (drivers/pci/hotplug)Medium
• Linux kernel (drivers/pci/hotplug): Powering off a physical function that still has child virtual functions drops theCVE-2025-37946 · Linux kernel (drivers/pci/hotplug)Medium
• Linux kernel (drivers/pci/hotplug): A power fault on a PCIe hotplug slot latches a sticky status bit that the hardirqCVE-2021-47617 · Linux kernel (drivers/pci/hotplug)Medium
• Linux kernel (drivers/gpu/drm/xe): Same per-client accounting path, different failure - if the fdinfo read drops theCVE-2024-46867 · Linux kernel (drivers/gpu/drm/xe)Medium