CVE-2025-38623None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Fix surprise plug detection and recovery The existing PowerNV hotplug code did not handle surprise plug events correctly, leading to a complete failure o…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
PCI: pnv_php: Fix surprise plug detection and recovery
The existing PowerNV hotplug code did not handle surprise plug events correctly, leading to a complete failure of the hotplug system after device removal and a required reboot to detect new devices.
This comes down to two issues:
When a device is surprise removed, often the bridge upstream port will cause a PE freeze on the PHB. If this freeze is not cleared, the MSI interrupts from the bridge hotplug notification logic will not be received by the kernel, stalling all plug events on all slots associated with the PE.
When a device is removed from a slot, regardless of surprise or programmatic removal, the associated PHB/PE ls left frozen. If this freeze is not cleared via a fundamental reset, skiboot is unable to clear the freeze and cannot retrain / rescan the slot. This also requires a reboot to clear the freeze and redetect the device in the slot.
Issue the appropriate unfreeze and rescan commands on hotplug events, and don't oops on hotplug if pci_bus_to_OF_node() returns NULL.
[bhelgaas: tidy comments]
Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 6e7b5f922901585b8f11e0d6cda12bda5c59fc8aLinux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 2ec8ec57bb8ebde3e2a015eff80e5d66e6634fe3Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 473999ba937eac9776be791deed7c84a21d7880bLinux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 6e7b24c71e530a6c1d656e73d8a30ee081656844Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 48c6935a34981bb56f35be0774ec1f30c6e386f8Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 1d2f63680c5719a5da92639e981c6c9a87fcee08Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < 78d20b8c13075eae3d884c21db7a09a6bbdda5b2Linux >= 360aebd85a4c946764f6301d68de2a817fad5159 < a2a2a6fc2469524caa713036297c542746d148dcLinux 4.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses