Junglewise Threat Intelligence

CVE-2026-74331: Linux kernel firmware loader recursive locking deadlock

CVE-2026-74331 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's firmware loader—a critical system component that loads device firmware during suspend and hibernation—can deadlock under out-of-memory conditions. When memory pressure forces the firmware loader to execute work synchronously instead of asynchronously, the same thread tries to acquire a lock it already holds, freezing the system during power state transitions. This fix releases the lock before the risky operation, preventing system hangs during suspend.

Technical details

The vulnerability is a recursive lock deadlock in device_cache_fw_images() within the firmware loader subsystem (drivers/base/firmware_loader/main.c). The function acquires fw_lock to update FW_LOADER_START_CACHE state, then iterates devices via dpm_for_each_dev() while holding the lock. When async_schedule_node_domain() fails to allocate memory, it executes work synchronously in the current thread. The execution path (__async_dev_cache_fw_image → cache_firmware → request_firmware → assign_fw) attempts to acquire fw_lock again, causing deadlock. The fix reorders operations to release fw_lock immediately after the state update and before the potentially-blocking iteration. The lock is only needed to protect the state change; concurrent requests are protected by independent fwc->name_lock. Patch is available in mainline and stable kernels.

Affected products

  • Linux Linux kernel multiple versions (see stable tree branches linux-2.6.11.y through linux-7.2.y and rolling branches)

Timeline

  • 2026-08-15: disclosed: CVE-2026-74331 published
  • 2026-05-29: patched: Upstream commit d3ec78f8f8d48a04a9fac38d47275c34645e5103 by Dmitry Vyukov
  • 2026-07-24: patched: Integrated into stable kernels

References

Related threats