A bug in the Linux kernel’s pci_slot_trylock function left an unintended pci_dev_unlock call on the failure path after the bridge device lock was no longer acquired. When the nested pci_bus_trylock fails, the removed unlock logic triggers either a warning that a lock is being released without being held or an incorrect release of a lock that belongs to another thread. These errors are the only outcomes explicitly stated in the description and reflect the improper lock state that arises when the buggy code path is exercised.

Any installation running the Linux kernel that contains the buggy pci_slot_trylock implementation is affected. The vendor list identifies Linux, and the description indicates that versions lacking the commit a4e772898f8b are vulnerable. No precise version range is provided, so all kernel releases prior to the inclusion of this fix may be impacted.

The CVSS score of 7.8 marks the issue as high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require triggering the failure path in pci_slot_trylock, which would typically involve running privileged kernel‑level code such as a malicious module or driver. No known exploits are documented; therefore the attack vector is inferred as local privileged execution, and the overall risk is judged as high severity but low probability.