CVE-2024-46761

What it actually does

NULL pointer dereference in pci/hotplug/pnv_php.c during unregistration after MSI data structure has already been freed on PowerNV platforms, triggered when attempting to hot-unplug or disable a PCIe switch/bridge from the PHB.

Why it matters to the business

Unexpected kernel crashes and system downtime on affected PowerPC hardware when performing PCIe hot-unplug operations, increasing operational risk for environments relying on dynamic hardware reconfiguration.

How an attack unfolds

An attacker with local administrative access on a vulnerable PowerNV system initiates a PCIe hot-unplug or disable sequence targeting a switch or bridge attached to the PHB; the driver path attempts to call pci_disable_msi after the MSI structure has been released and set to NULL, resulting in a crash. Threat actor mentions of espionage and financially motivated campaigns highlight the broader Linux kernel attack surface but this specific flaw has not been observed in KEV or ransomware activity.

How to fix it

Update the Linux kernel to a version containing commit 4eb4085c1346d19d4a05c55246eb93e74e671048 or later stable releases that include the fix for pnv_php unregistration path.

How to confirm the fix worked

Confirm the presence of commit 4eb4085c1346d19d4a05c55246eb93e74e671048 in the running kernel source or verify that hot-unplug operations on PCIe switches no longer produce NULL pointer dereference panics in dmesg.

Typical attack path

1. Obtain local root or sufficient privileges on a PowerNV Linux system
2. Identify and select a target PCIe switch or bridge for hot-unplug via sysfs or similar interfaces
3. Trigger the disable or removal operation in the pnv_php driver
4. Trigger NULL dereference during unregistration when pci_disable_msi is called on already-freed MSI data

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing pnv_php.c, pci_disable_msi, or NULL pointer dereference during hot-unplug sequences; correlate with audit logs showing PCIe device removal attempts.

What your security team should do

• Prioritize kernel upgrades on all PowerNV systems to the fixed commit or equivalent stable branch
• Restrict hotplug privileges to trusted administrators until patches are applied
• Monitor kernel logs for pnv_php and pci_disable_msi related oops entries during maintenance windows