In the Linux kernel, the following vulnerability has been resolved:

ata: pata sl82c105: fix bridge revision use-after-free

pci get slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci dev put(). The bridge may therefore be freed before its revision is read.

Read the revision before dropping the reference.