CVE-2024-26605: PCI/ASPM: Fix deadlock when enabling ASPM

Published Feb 24, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Fix deadlock when enabling ASPM

A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep:

============================================ WARNING: possible recursive locking detected 6.7.0 #40 Not tainted -------------------------------------------- kworker/u16:5/90 is trying to acquire lock: ffffacfa78ced000 (pcibussem){++++}-{3:3}, at: pcieaspmpmstatechange+0x58/0xdc

but task is already holding lock: ffffacfa78ced000 (pcibussem){++++}-{3:3}, at: pciwalkbus+0x34/0xbc

other info that might help us debug this: Possible unsafe locking scenario:

CPU0 ---- lock(pcibussem); lock(pcibussem);

DEADLOCK

Call trace: printdeadlockbug+0x25c/0x348 lockacquire+0x10a4/0x2064 lockacquire+0x1e8/0x318 downread+0x60/0x184 pcieaspmpmstatechange+0x58/0xdc pcisetfullpowerstate+0xa8/0x114 pcisetpowerstate+0xc4/0x120 qcompcieenableaspm+0x1c/0x3c [pcieqcom] pciwalkbus+0x64/0xbc qcompciehostpostinit270+0x28/0x34 [pcieqcom]

The deadlock can easily be reproduced on machines like the Lenovo ThinkPad X13s by adding a delay to increase the race window during asynchronous probe where another thread can take a write lock.

Add a new pcisetpowerstatelocked() and associated helper functions that can be called with the PCI bus semaphore held to avoid taking the read lock twice.

Other sources

In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Fix deadlock when enabling ASPM

The Linux kernel CVE team has assigned CVE-2024-26605 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024022419-CVE-2024-26605-7b06@gregkh/T/#u

— Red Hat

Affected Software

115 affected componentsFixes available
redhat/kernel<6.8
6.8
Linux Linux kernel>=6.7.0<6.7.5
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.15*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15*
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm-5.15*
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15*
ubuntu/linux-lowlatency-hwe-5.15*
ubuntu/linux-nvidia-tegra-5.15*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15*
ubuntu/linux-riscv-5.8*
ubuntu/linux*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-azure*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gke*
ubuntu/linux-gkeop*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-ibm*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg*
ubuntu/linux-kvm*
ubuntu/linux-lowlatency*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-tegra*
ubuntu/linux-nvidia-tegra-igx*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle*
ubuntu/linux-oracle-6.5*
ubuntu/linux-raspi*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp*
ubuntu/linux-bluefield*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-raspi-realtime<6.8.0-2001.1
6.8.0-2001.1
debian/linux<6.1.90-1
6.1.90-1
debian/linux<6.7.7-1
6.7.7-1
debian/linux<6.7.7-1
6.7.7-1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.8
  2. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2001.1
  3. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.90-1
  4. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.7.7-1
  5. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1

Event History

Feb 24, 2024
CVE Published
via MITRE·03:17 PM
Data Sourced
via MITRE·03:17 PM
Description
Data Sourced
via Red Hat·05:18 PM
DescriptionSeverityAffected Software
Feb 26, 2024
Data Sourced
via NVD·04:28 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·04:28 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2024-26605?

CVE-2024-26605 is considered a significant issue due to the potential deadlock it introduces when enabling ASPM.

2

How do I fix CVE-2024-26605?

To fix CVE-2024-26605, update your Linux kernel to version 6.8 or later.

3

Which versions of the Linux kernel are affected by CVE-2024-26605?

Versions of the Linux kernel between 6.7.0 and 6.7.5 are affected by CVE-2024-26605.

4

What components are impacted by CVE-2024-26605?

CVE-2024-26605 impacts the PCI/ASPM capability in the Linux kernel, specifically related to Qualcomm PCIe controllers.

5

Is there a patch available for CVE-2024-26605?

Yes, a patch is available in Linux kernel version 6.8 and it is recommended to upgrade to this version to resolve the issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203