CVE-2025-38137

What it actually does

Use-after-free in Linux kernel PCI/pwrctrl when rescan_work_func executes after pwrctrl driver unload during device unregister, allowing access to freed data structures.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on affected Linux systems, particularly those using dynamic PCI power management, increasing downtime and security risk in servers and embedded devices.

How an attack unfolds

An attacker triggers prolonged execution of rescan_work_func while simultaneously unloading a pwrctrl driver, causing the work item to reference freed memory after unregister completes and data structures are cleaned up.

How to fix it

Update Linux kernel to the fixed commit b3ad6d23fec23fbef382ce9ea640c37446593cf5 or later stable versions; for nsc-fips (Chainguard) upgrade to 2.11.0-r2 or newer.

How to confirm the fix worked

Confirm kernel source contains the cancel work logic in PCI/pwrctrl unregister path and verify no outstanding rescan work after driver unload via code review or runtime testing.

Typical attack path

1. Identify system with PCI power control and loadable pwrctrl drivers
2. Force rescan_work_func to delay execution
3. Unload pwrctrl driver to initiate unregister and cleanup
4. Trigger use-after-free when delayed work accesses freed structures

How to detect it

Review kernel logs for PCI power control errors or oops around driver unload events; inspect for workqueue anomalies tied to rescan_work_func.

What your security team should do

• Prioritize kernel updates on systems exposing PCI power control interfaces
• Monitor EPSS trend for any increase in exploit likelihood
• Apply fixes within standard patch cycles given low current EPSS and no KEV listing