Use-After-Free Vulnerability in Linux Kernel Affecting PCI Power Control Drivers

CVE-2025-38137

What is CVE-2025-38137?

A use-after-free vulnerability exists within the Linux kernel related to the PCI power control subsystem. This issue can be exploited when rescan_work_func() is prolonged, combined with the unloading of a pwrctrl driver. This situation allows an attacker to cancel outstanding rescan work improperly, leading to potential system instability and exposure of sensitive information. The adequate handling of cancellation of work ensures that data structures are maintained correctly, preventing exploitation.

References