Executive brief
A race condition vulnerability was identified in the Linux kernel's power management subsystem during device removal. This flaw could allow a local attacker to cause a system crash or unpredictable behavior by triggering a 'use-after-free' error when hardware components are being disconnected or removed. The issue primarily impacts system stability and availability.
Technical details
A race condition exists in the pm_runtime_work() function of the Linux kernel's power management subsystem. The vulnerability occurs because the dev->parent pointer may be dereferenced after the parent device has already been freed during a removal operation. This results in a slab-use-after-free, as evidenced by KASAN reports during block device testing. An attacker with local access could potentially exploit this race condition to cause a kernel panic (DoS). The fix involves inserting a flush_work() call in pm_runtime_remove() to ensure pending runtime power management tasks are completed before the device is reinitialized or freed.
Affected products
- Linux Linux Kernel 2.6.32 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-12: patched: Initial patch authored by Bart Van Assche
- 2026-04-03: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/20f6e2e22a9c6234113812d5f300d3e952a82721
- https://git.kernel.org/stable/c/29ab768277617452d88c0607c9299cdc63b6e9ff
- https://git.kernel.org/stable/c/39f2d86f2ddde8d1beda05732f30c7cd945e0b5a
- https://git.kernel.org/stable/c/5649b46af8b167259e8a8e4e7eb3667ce74554b5
- https://git.kernel.org/stable/c/b6dd1a562ca8ba96c8ecb247c62b73f9fa02d47e
- https://git.kernel.org/stable/c/bb081fd37f8312651140d7429557258afe51693d
- https://git.kernel.org/stable/c/c6febaacfb8a0aec7d771a0e6c21cd68102d5679