The Linux kernel has a race condition in the PCI Altera driver that occurs when a root bus is stopped and without acquiring the pci_rescan_remove_lock. Concurrent rescan or hotplug operations triggered via sysfs can free the bus before the removal completes, which can lead to a use‑after‑free in kernel space, corrupting memory and potentially causing a system crash. This flaw aligns with the weakness described by CWE‑413.

All Linux distributions that ship a kernel built from the affected source code are impacted. Because the issue is tied to the generic linux_kernel family, any kernel version lacking the patch from commit 7cbb8f2750d91e64caff89e164ac8280bb80bedc or later is potentially vulnerable, including stock kernels in RHEL, Ubuntu, Debian, SUSE and other mainstream distros until a fix is applied.

The CVSS score of 5.5 indicates moderate overall risk. The EPSS score of less than 1% suggests exploitation is unlikely under current conditions, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the use‑after‑free in kernel space can be triggered by local privileged or system processes that can perform PCI hotplug or sysfs operations, removing the race eliminates the crash risk.