Executive brief
The Linux kernel's Rockchip PCI controller driver failed to properly protect root bus removal operations against concurrent rescan or hotplug requests. This race condition can lead to use-after-free memory errors or system crashes when PCI devices are removed while concurrent operations attempt to access the bus.
Technical details
A race condition exists in drivers/pci/controller/pcie-rockchip-host.c where pci_stop_root_bus() and pci_remove_root_bus() are called without holding the pci_rescan_remove_lock, allowing concurrent sysfs-triggered rescan or hotplug operations to access freed memory. The fix adds pci_lock_rescan_remove() and pci_unlock_rescan_remove() calls around the bus removal sequence to serialize access and prevent use-after-free.
Affected products
- Linux kernel multiple versions (see git stable tree branches)
Timeline
- 2026-09-24: disclosed