Executive brief
The Linux kernel's firmware loader—a critical system component that loads device firmware during suspend and hibernation—can deadlock under out-of-memory conditions. When memory pressure forces the firmware loader to execute work synchronously instead of asynchronously, the same thread tries to acquire a lock it already holds, freezing the system during power state transitions. This fix releases the lock before the risky operation, preventing system hangs during suspend.
Technical details
The vulnerability is a recursive lock deadlock in device_cache_fw_images() within the firmware loader subsystem (drivers/base/firmware_loader/main.c). The function acquires fw_lock to update FW_LOADER_START_CACHE state, then iterates devices via dpm_for_each_dev() while holding the lock. When async_schedule_node_domain() fails to allocate memory, it executes work synchronously in the current thread. The execution path (__async_dev_cache_fw_image → cache_firmware → request_firmware → assign_fw) attempts to acquire fw_lock again, causing deadlock. The fix reorders operations to release fw_lock immediately after the state update and before the potentially-blocking iteration. The lock is only needed to protect the state change; concurrent requests are protected by independent fwc->name_lock. Patch is available in mainline and stable kernels.
Affected products
- Linux Linux kernel multiple versions (see stable tree branches linux-2.6.11.y through linux-7.2.y and rolling branches)
Timeline
- 2026-08-15: disclosed: CVE-2026-74331 published
- 2026-05-29: patched: Upstream commit d3ec78f8f8d48a04a9fac38d47275c34645e5103 by Dmitry Vyukov
- 2026-07-24: patched: Integrated into stable kernels