CVE-2025-38623

What it actually does

The PowerNV PCI hotplug code fails to clear PE freezes on surprise device removal, preventing MSI interrupt delivery for hotplug notifications and leaving the PHB/PE frozen so skiboot cannot retrain or rescan slots.

Why it matters to the business

Servers using PowerNV hotplug experience complete loss of plug/unplug functionality after any device removal, forcing unplanned reboots that interrupt workloads and extend recovery time in environments with frequent hardware changes.

How an attack unfolds

An attacker with local access removes a PCIe device (surprise or programmatic), triggering an uncleared PE freeze that stalls all subsequent hotplug events on the affected PHB; listed threat actors such as VMSCAPE have been associated with related Linux kernel privilege-escalation activity but no public exploitation of this specific flaw is recorded.

How to fix it

Update the Linux kernel to commit 6e7b5f922901585b8f11e0d6cda12bda5c59fc8a or later; Chainguard users should upgrade openjdk-8-openj9 packages to 0.53.0-r1 or newer; apply the unfreeze/rescan logic and NULL-check for pci_bus_to_OF_node() on all affected stable trees.

How to confirm the fix worked

Verify the running kernel contains commit 6e7b5f922901585b8f11e0d6cda12bda5c59fc8a, confirm hotplug events succeed after device removal without requiring reboot, and inspect dmesg for absence of frozen-PE stalls.

Typical attack path

1. Obtain local access to a PowerNV system
2. Trigger surprise or normal removal of a device from a hotplug-capable slot
3. Cause the upstream bridge to freeze the PE without clearing it
4. Observe stalled hotplug notifications and failed rescan until reboot

How to detect it

Search kernel logs for repeated PE-freeze messages, stalled hotplug notifications, or calls to pnv_php functions around device removal events; correlate with skiboot rescan failures.

• pnv_php
• pci_bus_to_OF_node
• PE freeze
• hotplug notification
• fundamental reset

What your security team should do

• Prioritize kernel upgrades on all PowerNV systems within the next maintenance window
• Monitor EPSS trend and any new threat-actor mentions for 30 days post-patch
• Test hotplug functionality in staging before production rollout
• Document the fixed commit hash in change-management records