VulnerabilityPublished 3 Jul 2025Updated 21 Oct 2026

CVE-2025-38137: Linux kernel · PCI/pwrctrl: Cancel outstanding rescan work when unregistering

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in b3ad6d23fec23fbef382ce9ea640c37446593cf5 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:30 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in b3ad6d23fec23fbef382ce9ea640c37446593cf5, a63ed775f476ba81558bba24d7538836e1ffb823, 8b926f237743f020518162c62b93cb7107a2b5eb

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to b3ad6d23fec23fbef382ce9ea640c37446593cf5, a63ed775f476ba81558bba24d7538836e1ffb823 or 8b926f237743f020518162c62b93cb7107a2b5eb.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8f62819aaace77dd85037ae766eb767f8c4417ce, < b3ad6d23fec23fbef382ce9ea640c37446593cf5	Fixed in b3ad6d23fec23fbef382ce9ea640c37446593cf5
LinuxLinux	Affected ≥ 8f62819aaace77dd85037ae766eb767f8c4417ce, < a63ed775f476ba81558bba24d7538836e1ffb823	Fixed in a63ed775f476ba81558bba24d7538836e1ffb823
LinuxLinux	Affected ≥ 8f62819aaace77dd85037ae766eb767f8c4417ce, < 8b926f237743f020518162c62b93cb7107a2b5eb	Fixed in 8b926f237743f020518162c62b93cb7107a2b5eb
LinuxLinux	Affected =6.11	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: (a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl driver that may be unloaded for some reason Cancel outstanding work to ensure it is finished before we allow our data structures to be cleaned up. [bhelgaas: tidy commit log]

References

Community reviews

Loading reviews…