A race condition exists in the Linux kernel’s iproc PCI driver when a root bus is removed. During removal the pci_rescan_remove_lock is not held, allowing another thread to trigger a rescan or hot‑plug operation through sysfs. The concurrent actions can cause the driver to dereference memory that has already been freed, leading to a use‑after‑free crash of the kernel and a complete loss of availability.

All Linux kernel versions that include the iproc driver and lack the fix introduced by commits a6a64e1, bd2bf1e and ee06aaf are affected. This encompasses every unpatched kernel build released before the inclusion of those patches; any machine running such a kernel is vulnerable.

The vulnerability can be exploited from user space by writing to the /sys/class/pci_bus interface to initiate root bus removal while another process triggers a rescan. The race can reliably cause a crash, resulting in a denial of service. No EPSS score is available and the issue is not listed in the CISA KEV catalog, but the local attack vector and the guarantee of a crash make the risk high for any system exposed to unprivileged users with access to the sysfs entries.