CVE-2023-52860: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52860 affects the Linux kernel's performance monitoring unit (PMU) driver for HiSilicon HNS3 devices. The vulnerability was discovered in the driver's CPU hotplug handling mechanism, specifically in the PMU uninitialization process (Kernel Git).

The vulnerability stems from an incorrect sequence in the PMU teardown process where CPU hotplug callbacks were executed after the device had been unregistered. This led to NULL pointer dereference issues when attempting to execute empty function callbacks within the driver. The issue manifests specifically in the hisi_hns3_pmu driver during the PMU uninitialization process (Kernel Git).

When exploited, this vulnerability could cause a kernel NULL pointer dereference at virtual address 0x0, potentially leading to system crashes or denial of service conditions. The issue specifically affects systems running the HiSilicon HNS3 PMU driver (Kernel Git).

The vulnerability is triggered during the PMU device teardown process, specifically when unregistering the HNS3 PMU device. The issue requires access to a system with the HiSilicon HNS3 PMU driver loaded and the ability to trigger the driver's uninitialization sequence (Kernel Git).

The fix involves replacing the use of cpuhp_state_remove_instance() with cpuhp_state_remove_instance_nocalls() to prevent the execution of notifiers after the PMU device has been unregistered. This change has been implemented in the kernel source code to address the vulnerability (Kernel Git).