CVE-2025-38137: PCI/pwrctrl: Cancel outstanding rescan work when unregistering
In the Linux kernel, the following vulnerability has been resolved:
PCI/pwrctrl: Cancel outstanding rescan work when unregistering
It's possible to trigger use-after-free here by:
(a) forcing rescanworkfunc() to take a long time and (b) utilizing a pwrctrl driver that may be unloaded for some reason
Cancel outstanding work to ensure it is finished before we allow our data structures to be cleaned up.
[bhelgaas: tidy commit log]
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38137?
The severity of CVE-2025-38137 is classified as high due to the potential for a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2025-38137?
To fix CVE-2025-38137, update the Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-38137?
CVE-2025-38137 affects multiple versions of the Linux kernel prior to the security patch.
What type of vulnerability is CVE-2025-38137?
CVE-2025-38137 is a use-after-free vulnerability that can be triggered through specific driver interactions.
Can CVE-2025-38137 be exploited remotely?
Exploitation of CVE-2025-38137 typically requires local access to the system, making remote exploitation unlikely.