Linux Kernel EUVD-2026-25488

The affected component is pci-epf-vntb, the Linux kernel's PCI Endpoint Function driver implementing a Virtual Non-Transparent Bridge (NTB). PCIe NTB is a specialized interconnect technology allowing two separate host systems to share memory regions directly over a PCIe fabric. The driver registers a delayed work queue (cmd_handler) to poll command registers in shared BAR (Base Address Register) memory. The cleanup function epf_ntb_epc_cleanup is responsible for unmapping those BARs and releasing doorbells, but the patch data confirms it was not calling cancel_delayed_work_sync() before doing so. If the work fires after teardown, it dereferences the now-invalid virtual address (shown as ffff800083f46004 in the oops trace), producing an Internal error: Oops: 0000000096000007. No formal CWE is assigned in NVD data, but the root cause class is a use-of-freed-resource in a concurrent cleanup path. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected kernel. The fix adds a work cancellation call at the top of the cleanup path before any resource teardown.