CVE-2025-38624

What it actually does

Leaks allocated IRQ resources for child bridges during unplug of nested PCIe root bridges in the pnv_php driver, causing use-after-free or invalid release during device teardown and a kernel panic in msi_device_data_release.

Why it matters to the business

System crashes and loss of availability during PCIe hot-unplug operations on affected PowerPC platforms; low prevalence outside specific kernel configurations reduces overall exposure but still requires patching to maintain stability.

How an attack unfolds

An attacker with sufficient privileges to trigger PCI hotplug events (via sysfs or physical access) unplugs a nested PCIe bridge root; the driver fails to deallocate IRQs for child buses before pci_hp_remove_devices, leading to panic on resource release. Threat actors listed in related Linux kernel container escapes have demonstrated interest in similar privilege-escalation paths but no public exploitation of this specific flaw has been observed.

How to fix it

Update the Linux kernel to commit 8c1ad4af160691e157d688ad9619ced2df556aac or later; for Chainguard packages upgrade openjdk-17-openj9 and related variants to 0.53.0-r0 which incorporate the fix. Rebuild and reboot systems after applying the kernel update.

How to confirm the fix worked

Verify the running kernel contains commit 8c1ad4af160691e157d688ad9619ced2df556aac; attempt hot-unplug of nested PCIe bridges in a test environment and confirm absence of the msi_device_data_release warning and panic.

Typical attack path

1. Obtain local or physical access to trigger PCI slot attributes
2. Write to power or hotplug sysfs files to initiate unplug of nested bridge
3. Trigger pnv_php_disable_slot and subsequent pci_hp_remove_devices
4. Cause kernel panic via leaked IRQ MSI device data release

How to detect it

Search kernel logs and dmesg for the exact panic stack trace containing msi_device_data_release, release_nodes, pci_hp_remove_devices, and pnv_php_disable_slot; correlate with sysfs writes to pci_slot_attr_store around the time of the crash.

• msi_device_data_release+0x6c/0x9c
• pnv_php_disable_slot+0x54/0xd4
• WARNING: CPU:.*PID:.*at kernel/irq/msi.c:292
• pci_hp_remove_devices+0x90/0x128

What your security team should do

• Prioritize kernel updates on PowerPC systems using pnv_php hotplug
• Test hotplug functionality in staging environments before production rollout
• Monitor for related container-escape activity given listed threat actor interest in Linux kernel flaws
• Apply updates within standard patch windows since no KEV listing or high EPSS