The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PCI: pnv_php: Fix surprise plug detection and recovery The existing PowerNV hotplug code did not handle     surprise plug events correctly, leading to a complete failure of the hotplug system after device removal     and a required reboot to detect new devices. This comes down to two issues: 1) When a device is surprise     removed, often the bridge upstream port will cause a PE freeze on the PHB. If this freeze is not cleared,     the MSI interrupts from the bridge hotplug notification logic will not be received by the kernel, stalling     all plug events on all slots associated with the PE. 2) When a device is removed from a slot, regardless     of surprise or programmatic removal, the associated PHB/PE ls left frozen. If this freeze is not cleared     via a fundamental reset, skiboot is unable to clear the freeze and cannot retrain / rescan the slot. This     also requires a reboot to clear the freeze and redetect the device in the slot. Issue the appropriate     unfreeze and rescan commands on hotplug events, and don't oops on hotplug if pci_bus_to_OF_node() returns     NULL. [bhelgaas: tidy comments] (CVE-2025-38623)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Published	Updated	Severity
260264	Linux Distros Unpatched Vulnerability : CVE-2025-38623	Nessus	Misc.	9/2/2025	9/10/2025	medium
265433	Photon OS 4.0: Linux PHSA-2025-4.0-0864	Nessus	PhotonOS Local Security Checks	9/19/2025	9/19/2025	high

Detections

Analytics

Plugins Search

medium

high