Linux kernel (drivers/pci/hotplug): Powering off a physical function that still has child virtual functions drops the

CVSS 6.4CVE-2025-37946Kernel, userspace & hypervisorcurated

Impact

Powering off a physical function that still has child virtual functions drops the pci_dev reference twice. The refcount underflows, the struct pci_dev can be freed while still in use, and the host then operates on a released device object - a use-after-free reachable through the PF/VF lifecycle, which is the same lifecycle that hands VFs to tenants.

Who can reach it

s390 only - the bug is in the s390 PCI hotplug slot driver, so it applies to Linux in an IBM Z LPAR or z/VM guest, not to x86 or ARM GPU nodes. Reached by writing to the slot power attribute in sysfs (host root) for a PF that still has VFs attached; the double put is on the path that was supposed to REFUSE that operation. Include it in your inventory only if s390 is part of your estate; on a conventional GPU fleet it is inert.

What to do

Update to a kernel carrying the fix (no fixed_in published; stable commits below). Interim on s390: disable all VFs on a PF before powering its slot off, and keep slot power control out of any automation that runs while VFs are assigned.

References

https://git.kernel.org/stable/c/c488f8b53e156d6dcc0514ef0afa3a33376b8f9e https://git.kernel.org/stable/c/957529baef142d95e0d1b1bea786675bd47dbe53 https://nvd.nist.gov/vuln/detail/CVE-2025-37946

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.