LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38576: powerpc/eeh: Make EEH driver device hotplug safe

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Make EEH driver device hotplug safe Multiple race conditions existed between the PCIe hotplug driver and the EEH driver, leading to a variety of kernel oopses of the same general nature: <pcie device unplug> <eeh driver trigger> <hotplug removal trigger> <pcie tree reconfiguration> <eeh recovery next step> <oops in EEH driver bus iteration loop> A second class of oops is also seen when the underlying bus disappears during device recovery. Refactor the EEH module to be PCI rescan and remove safe. Also clean up a few minor formatting / readability issues.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash affected PowerPC systems during PCIe device hotplug or EEH recovery handling. The business risk is mainly availability: a kernel oops can interrupt workloads. The sources do not show remote exploitation, data theft, or active abuse.

Executive priority

Treat as a targeted availability risk for PowerPC Linux infrastructure, not a broad internet-facing emergency based on current evidence. Patch through normal kernel maintenance, faster for critical systems using PCIe hotplug or EEH recovery.

Technical view

CVE-2025-38576 fixes race conditions between the PCIe hotplug driver and PowerPC EEH recovery code. During device unplug, hotplug removal, PCIe tree reconfiguration, or bus disappearance, EEH bus iteration and recovery paths could dereference invalid state and oops the kernel.

Likely exposure

Exposure appears limited to Linux on PowerPC systems using EEH and PCIe hotplug paths. The source lists Linux as affected across several kernel streams and provides multiple stable kernel commits. Non-PowerPC systems are not identified as affected in the bundle.

Exploitation context

KEV is false, and the provided sources do not claim active exploitation or public weaponization. The described trigger is operational: PCIe device unplug or hotplug activity racing with EEH recovery. Required attacker position is not stated.

Researcher notes

The source bundle lacks CVSS, CWE, privilege requirements, and affected configuration detail beyond Linux PowerPC EEH context. Analysis should stay constrained to kernel oops availability impact unless vendor advisories add exploitability information.

Mitigation direction

  • Apply Linux stable kernel updates containing the referenced EEH hotplug-safety fixes.
  • Use distribution kernel advisories, including Debian LTS where relevant, for packaged updates.
  • Prioritize affected PowerPC hosts with PCIe hotplug or error-recovery activity.
  • Avoid unscheduled PCIe hotplug operations on exposed systems until patched.

Validation and detection

  • Inventory PowerPC Linux hosts and record running kernel versions.
  • Check whether vendor kernels include one of the referenced stable fixes.
  • Review kernel logs for EEH, PCIe hotplug, bus removal, or oops events.
  • After patching, confirm systems boot into the updated kernel.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38576 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1c2042c83aa7af10579b71a1fe5e22bbae69f08c, 1c2042c83aa7af10579b71a1fe5e22bbae69f08c, 1c2042c83aa7af10579b71a1fe5e22bbae69f08c, 1c2042c83aa7af10579b71a1fe5e22bbae69f08c, 1c2042c83aa7af10579b71a1fe5e22bbae69f08c, 1c2042c83aa7af10579b71a1fe5e22bbae69f08c, 1c2042c83aa7af10579b71a1fe5e22bbae69f08c, 1c2042c83aa7af10579b71a1fe5e22bbae69f08cunaffected
LinuxLinux3.14, 0, 5.10.241, 5.15.190, 6.1.148, 6.6.102, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.