Executive brief
The Linux kernel's PCI hotplug driver for s390 systems contains a bug where resetting a PCI device function can reset the wrong function and leak memory. This affects s390 systems using hypervisor-based PCI pass-through when multifunction PCI devices are present, potentially causing system instability and memory exhaustion over time.
Technical details
The vulnerability is a logic error in PCI slot assignment and memory management. On s390 systems, the pci_create_slot() function incorrectly assigns the same pci_slot object to all functions within a multifunction PCI device. When the hotplug driver's reset_slot() function attempts to reset an individual function through zpci_hot_reset_device(), it operates on the wrong function due to the shared slot assignment. Additionally, pci_slot_release() fails to properly free pci_slot objects created for individual functions, causing memory leaks. The fix introduces a per-function PCI slot flag and modifies the slot 'number' field from u16 to u32 to support special values (PCI_SLOT_PLACEHOLDER, PCI_SLOT_ALL_DEVICES). No exploitation in the wild has been reported.
Affected products
- Linux Linux kernel
Timeline
- 2026-09-16: disclosed