CVE-2025-38137

In the Linux kernel, the following vulnerability has been resolved:

PCI/pwrctrl: Cancel outstanding rescan work when unregistering

It's possible to trigger use-after-free here by:

(a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl driver that may be unloaded for some reason

Cancel outstanding work to ensure it is finished before we allow our data structures to be cleaned up.

[bhelgaas: tidy commit log]

Fixes a use-after-free vulnerability in the PCI/pwrctrl subsystem. If rescan_work_func() is still executing when the pwrctrl structure is freed (e.g., upon driver removal), the system may crash or exhibit undefined behavior. The vulnerability can potentially be triggered by a local attacker with limited privileges by forcing long-running rescan work and unloading the related driver concurrently. This bug not introduced yet in any version of the Red Hat Enterprise Linux, so not affected for all versions (apart from latest Red Hat Enterprise Linux 10 where going to check this additionally).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.