CVE-2023-52860

What it actually does

Incorrect CPU hotplug notifier ordering during hisi_hns3_pmu teardown triggers a NULL pointer dereference inside perf_pmu_migrate_context after the PMU device has already been unregistered.

Why it matters to the business

Systems using HiSilicon HNS3 network hardware may experience unexpected kernel crashes or instability during device removal, CPU offline events, or driver unload, leading to unplanned downtime and potential data loss on affected Linux servers.

How an attack unfolds

An attacker with local privileges or the ability to trigger device teardown (via module unload, hot-unplug, or container teardown) can cause the kernel to invoke stale CPU hotplug callbacks, resulting in a NULL dereference and denial of service. No remote or unauthenticated vectors are known.

How to fix it

Update the Linux kernel to a version containing commit 4589403a343bb0c72a6faf5898386ff964d4e01a or later; rebuild and deploy the updated kernel package on all affected hosts. No configuration workaround exists.

How to confirm the fix worked

Confirm the running kernel contains commit 4589403a343bb0c72a6faf5898386ff964d4e01a via 'git log' or package version; attempt PMU registration/unregistration plus CPU offline sequences in a test environment and verify absence of NULL dereference oops.

Typical attack path

1. Obtain local access or control over driver lifecycle on a system with hisi_hns3_pmu loaded
2. Trigger PMU device unregistration (module removal, PCI hot-unplug, or container shutdown)
3. Force or wait for a CPU offline event while the stale notifier remains registered
4. Kernel executes hisi_hns3_pmu_offline_cpu after device state is cleared, dereferencing NULL and panicking

How to detect it

Review kernel logs for oops or panic messages referencing perf_pmu_migrate_context or hisi_hns3_pmu_offline_cpu around the time of device removal or CPU hotplug events; correlate with dmesg timestamps showing PMU unregistration.

What your security team should do

• Prioritize kernel updates on all systems exposing HiSilicon HNS3 hardware within the next patching cycle
• Add the fixed commit ID to internal kernel build and SBOM tracking
• Monitor vendor advisories for backported patches in distribution kernels