The Linux kernel Mediatek PCI driver previously lacked a proper lock when stopping and removing a root bus. This omission created a race condition that could be triggered during concurrent rescan or hotplug operations via sysfs. The race may cause a use‑after‑free or kernel crash, potentially allowing an attacker to gain arbitrary code execution or cause a denial of service.

The vulnerability impacts all Linux kernel releases that include the Mediatek PCI driver before the commit that introduced pci_rescan_remove_lock. No specific version numbers are listed, so systems should treat any pre‑patch kernel as affected.

The CVSS score is not publicly available, and EPSS is not provided, placing the exploitation likelihood in the unknown range. The vulnerability is not currently listed in the CISA KEV catalog. However, because it relies on a kernel race condition and can result in an use‑after‑free, the risk to systems that handle PCI root bus removal is high enough to warrant immediate patching. Exploitation would likely require local or privileged access to trigger the race, but the potential for arbitrary code execution makes it a severe threat.