CVE-2025-38623

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The PowerNV hotplug code did not handle surprise plug events correctly, leading to a complete failure of the hotplug system after device removal and requiring a reboot to detect new devices. This occurred due to two issues: a failure to clear a PE freeze on the PHB when a device is surprise removed, stalling plug events; and a failure to clear a PHB/PE freeze after device removal, preventing skiboot from retraining/rescaning the slot. The issue was resolved by issuing appropriate unfreeze and rescan commands on hotplug events and avoiding errors when pci bus to OF node() returns NULL.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.