LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38623: PCI: pnv_php: Fix surprise plug detection and recovery

In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Fix surprise plug detection and recovery The existing PowerNV hotplug code did not handle surprise plug events correctly, leading to a complete failure of the hotplug system after device removal and a required reboot to detect new devices. This comes down to two issues: 1) When a device is surprise removed, often the bridge upstream port will cause a PE freeze on the PHB. If this freeze is not cleared, the MSI interrupts from the bridge hotplug notification logic will not be received by the kernel, stalling all plug events on all slots associated with the PE. 2) When a device is removed from a slot, regardless of surprise or programmatic removal, the associated PHB/PE ls left frozen. If this freeze is not cleared via a fundamental reset, skiboot is unable to clear the freeze and cannot retrain / rescan the slot. This also requires a reboot to clear the freeze and redetect the device in the slot. Issue the appropriate unfreeze and rescan commands on hotplug events, and don't oops on hotplug if pci_bus_to_OF_node() returns NULL. [bhelgaas: tidy comments]

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-38623 is a Linux kernel PowerNV PCI hotplug reliability flaw. On affected systems, unexpected PCI device removal can leave hardware state frozen, causing hotplug detection to stop until reboot. The main business risk is service disruption or delayed hardware replacement on specialized PowerNV/OpenPOWER infrastructure, not broad internet-facing compromise.

Executive priority

Prioritize for environments running PowerNV/OpenPOWER infrastructure with PCI hotplug needs. Treat as operational resilience work: patch during the next appropriate maintenance window unless affected systems support critical workloads requiring reliable hardware replacement.

Technical view

The Linux kernel pnv_php PowerNV hotplug path mishandled surprise removal and PHB/PE freeze recovery. Frozen PE state could block MSI hotplug notifications and prevent skiboot retrain/rescan, requiring reboot. The fix issues unfreeze and rescan actions on hotplug events and avoids an oops when pci_bus_to_OF_node() returns NULL.

Likely exposure

Exposure appears limited to Linux systems using PowerNV PCI hotplug functionality, typically IBM/OpenPOWER-class hardware. General Linux servers not using this platform-specific PCI hotplug path are unlikely to be exposed based on the provided sources.

Exploitation context

No source provided indicates active exploitation, public weaponization, or CISA KEV listing. The described trigger involves PCI hotplug or surprise device removal, suggesting operational or physical/local hardware interaction rather than remote network exploitation.

Researcher notes

Severity is not scored in the provided CVE data. The issue is kernel/platform-specific and appears availability-focused. Analysis should center on affected PowerNV hotplug code presence, kernel stable backports, and distro package status rather than generic Linux exposure.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Apply applicable distribution security updates, including Debian LTS guidance where relevant.
  • Use planned maintenance for PCI device changes until systems are patched.
  • Check vendor or distribution advisories for platform-specific kernel packages.

Validation and detection

  • Inventory Linux hosts running on PowerNV/OpenPOWER hardware.
  • Identify kernels using the pnv_php PowerNV PCI hotplug driver.
  • Compare installed kernel builds against vendor fixes or referenced stable commits.
  • Review logs for PCI hotplug failures, PE freezes, or reboot-required recovery after removals.
  • Confirm patched systems can recover hotplug events during approved maintenance testing.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38623 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux360aebd85a4c946764f6301d68de2a817fad5159, 360aebd85a4c946764f6301d68de2a817fad5159, 360aebd85a4c946764f6301d68de2a817fad5159, 360aebd85a4c946764f6301d68de2a817fad5159, 360aebd85a4c946764f6301d68de2a817fad5159, 360aebd85a4c946764f6301d68de2a817fad5159, 360aebd85a4c946764f6301d68de2a817fad5159, 360aebd85a4c946764f6301d68de2a817fad5159unaffected
LinuxLinux4.9, 0, 5.10.241, 5.15.190, 6.1.148, 6.6.102, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.