Executive brief
The Linux kernel's firmware loader subsystem has a race condition in its sysfs fallback mechanism that can result in freed memory being retained in an internal request list. When firmware is loaded via the fallback path, a timing window allows a userspace helper to complete the request before the kernel queues it as pending, potentially leaving a dangling pointer that causes a crash on the next firmware load attempt.
Technical details
The vulnerability is a use-after-free in the firmware_loader subsystem's sysfs fallback path (drivers/base/firmware_loader/fallback.c). The root cause is a race condition where fw_load_sysfs_fallback() calls device_add() before adding fw_priv to the pending_fw_head list. device_add() exposes the loading interface immediately, allowing a userspace helper to write to the loading attribute and call fw_state_done() before the request is queued as pending. This causes fw_state_done() to fail to remove the entry from pending_fw_head (since pending_list still points to itself), and the subsequent unconditional list_add() queues an already-completed fw_priv. Once released, this leaves a freed memory pointer in pending_fw_head, causing a fault when the next fallback request validates the list. The fix checks if the request is already DONE after device_add() and returns early without queueing it as pending.
Affected products
- Linux Linux kernel multiple versions (see upstream commit b48373c901951fad1a26bd7c33ad91172b3945b5)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-07-16: patched: Upstream patch authored by Mukesh Ojha