Junglewise Threat Intelligence

CVE-2026-23452: Linux Kernel race condition in PM runtime device removal

CVE-2026-23452 · Severity: medium · CVSS 4.7 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition vulnerability was identified in the Linux kernel's power management subsystem during device removal. This flaw could allow a local attacker to cause a system crash or unpredictable behavior by triggering a 'use-after-free' error when hardware components are being disconnected or removed. The issue primarily impacts system stability and availability.

Technical details

A race condition exists in the pm_runtime_work() function of the Linux kernel's power management subsystem. The vulnerability occurs because the dev->parent pointer may be dereferenced after the parent device has already been freed during a removal operation. This results in a slab-use-after-free, as evidenced by KASAN reports during block device testing. An attacker with local access could potentially exploit this race condition to cause a kernel panic (DoS). The fix involves inserting a flush_work() call in pm_runtime_remove() to ensure pending runtime power management tasks are completed before the device is reinitialized or freed.

Affected products

  • Linux Linux Kernel 2.6.32 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-12: patched: Initial patch authored by Bart Van Assche
  • 2026-04-03: advisory: CVE published to NVD

References

Related threats