CVE-2025-38137

by Fred · 03/07/2025

In the Linux kernel, the following vulnerability has been resolved:

PCI/pwrctrl: Cancel outstanding rescan work when unregistering

It’s possible to trigger use-after-free here by:

(a) forcing rescan_work_func() to take a long time and
(b) utilizing a pwrctrl driver that may be unloaded for some reason

Cancel outstanding work to ensure it is finished before we allow our data
structures to be cleaned up.

[bhelgaas: tidy commit log]