CVE-2026-23452

A flaw was found in the Linux kernel. A race condition within the power management (PM) runtime component, specifically during device removal, can lead to a use-after-free vulnerability. This allows a local attacker to potentially cause memory corruption. The most significant impact is a system crash, leading to a denial of service (DoS).

pm_runtime_work() could touch a parent device after it was freed when runtime work raced removal. The fix flushes pending work in pm_runtime_remove(). Triggers are timing-dependent and often seen under stress (for example block tests); practical impact is instability or crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.