Junglewise Threat Intelligence

CVE-2026-45904: Linux Kernel deadlock in PowerPC EEH event handling

CVE-2026-45904 · Severity: info · CVSS 0 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A flaw was discovered in the Linux kernel's handling of PCI hardware errors on PowerPC systems. This issue can cause the system to lock up (deadlock) when it attempts to recover from a hardware event, potentially leading to a complete system crash or denial of service. This affects the reliability of servers using PowerPC processors when hardware hotplugging or error recovery occurs.

Technical details

A deadlock vulnerability exists in the Linux kernel's powerpc/eeh driver due to recursive locking of 'pci_lock_rescan_remove'. The issue was introduced by a change intended to make the EEH driver hotplug-safe, which inadvertently caused 'eeh_handle_normal_event()' to acquire the rescan lock before calling 'eeh_pe_bus_get()', which then attempts to acquire the same lock. This nested acquisition results in a kernel deadlock, disrupting PCI error reporting and event handling. The fix introduces a non-locking variant of the bus retrieval function and ensures the lock is only acquired once at the appropriate scope. This affects PowerPC platforms (e.g., IBM POWER10) utilizing EEH for PCI error recovery.

Affected products

  • Linux Linux Kernel powerpc architecture versions including 6.18-rc3 and earlier stable branches

Timeline

  • 2025-12-10: patched: Initial patch submitted by IBM developers.
  • 2026-05-27: advisory: CVE-2026-45904 published.

References