A race condition in the Mediatek PCI driver allows the removal of a root bus without holding the pci_rescan_remove_lock lock. When a root bus is stopped and removed concurrently with rescan or hotplug operations triggered via sysfs, the missing synchronization can lead to a use‑after‑free scenario that may cause kernel memory corruption or a system crash. This reflects an improper lock usage scenario (CWE‑366).

The flaw exists in all Linux kernel releases that include the Mediatek PCI driver before the commit that introduced the pci_rescan_remove_lock. As no specific version numbers are indicated, any kernel containing the unpatched Mediatek PCI code is considered affected.

The CVSS score of 5.5 classifies the flaw as moderate severity. An EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the race can lead to a use‑after‑free or kernel crash, systems that perform PCI root bus removal are at risk of denial of service. Exploitation would likely require local or privileged access to trigger the race and may be mitigated by preventing concurrent rescans or hotplug events during maintenance.