Executive brief
A vulnerability was identified in the Linux kernel's PCI Peer-to-Peer Direct Memory Access (P2PDMA) subsystem. This flaw can cause the system to hang indefinitely when a user attempts to remove a PCI device if a specific memory allocation error occurred previously. This primarily impacts system availability and operational stability during hardware management tasks.
Technical details
A reference counting error exists in drivers/pci/p2pdma.c within the p2pmem_alloc_mmap() function. When vm_insert_page() fails, the function fails to call percpu_ref_put() to release the per-CPU reference of the page map (pgmap) acquired via gen_pool_alloc_owner(). This leaked reference prevents memunmap_pages() from completing, causing the kernel to hang indefinitely when attempting to hot-plug or remove the associated PCI device. The fix introduces the missing percpu_ref_put() call in the error path.
Affected products
- Linux Linux Kernel Fixed in 6.220694c52a5a04102b48109e4f24e958b559bd3 and related stable backports
Timeline
- 2025-12-20: other: Patch authored
- 2026-01-08: other: Patch committed to mainline
- 2026-05-27: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/51b7181cfbedf289ce794b6d97a1c596c309ec38
- https://git.kernel.org/stable/c/6220694c52a5a04102b48109e4f24e958b559bd3
- https://git.kernel.org/stable/c/a1f4dc72efc3204db95d052058d785cad7ce755f
- https://git.kernel.org/stable/c/baa42b756d183a59572f3890981a3d32b8d05d40
- https://git.kernel.org/stable/c/e19cce88ec4c4877f4ff2469099b9cf23cc3e93e