CVE-2026-23452: PM: runtime: Fix a race condition related to device removal

Q: What level of access and interaction does exploitation require?

The CVSS vector indicates local access and low privileges are required. No user interaction is required, but exploitation has high attack complexity.

Q: What runtime condition triggers the issue?

The race occurs when runtime power-management work can access a device's parent while the parent device is being removed and has already been freed. This can lead to a use-after-free during asynchronous runtime PM processing.

Q: How can administrators identify a possible occurrence?

A KASAN-enabled kernel may report a slab-use-after-free in lock_acquire, with pm_runtime_work, rpm_idle, and rpm_suspend in the call trace. The report was observed sporadically when running blktest block/001.

Q: What does the fix do?

The fix adds a flush_work() call in pm_runtime_remove(). This ensures pending runtime PM work is completed before device removal proceeds and prevents it from dereferencing a freed parent device.

Published Apr 3, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

PM: runtime: Fix a race condition related to device removal

The following code in pmruntimework() may dereference the dev->parent pointer after the parent device has been freed:

/ Maybe the parent is now able to suspend. / if (parent && !parent->power.ignorechildren) { spinunlock(&dev->power.lock);

spinlock(&parent->power.lock); rpmidle(parent, RPMASYNC); spinunlock(&parent->power.lock);

spinlock(&dev->power.lock); }

Fix this by inserting a flushwork() call in pmruntimeremove().

Without this patch blktest block/001 triggers the following complaint sporadically:

BUG: KASAN: slab-use-after-free in lockacquire+0x70/0x160 Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081 Workqueue: pm pmruntimework Call Trace: <TASK> dumpstacklvl+0x61/0x80 printaddressdescription.constprop.0+0x8b/0x310 printreport+0xfd/0x1d7 kasanreport+0xd8/0x1d0 kasancheckbyte+0x42/0x60 lockacquire.part.0+0x38/0x230 lockacquire+0x70/0x160 rawspinlock+0x36/0x50 rpmsuspend+0xc6a/0xfe0 rpmidle+0x578/0x770 pmruntimework+0xee/0x120 processonework+0xde3/0x1410 workerthread+0x5eb/0xfe0 kthread+0x37b/0x480 retfromfork+0x6cb/0x920 retfromforkasm+0x11/0x20 </TASK>

Allocated by task 4314: kasansavestack+0x2a/0x50 kasansavetrack+0x18/0x40 kasansaveallocinfo+0x3d/0x50 kasankmalloc+0xa0/0xb0 kmallocnoprof+0x311/0x990 scsialloctarget+0x122/0xb60 [scsimod] scsiscantarget+0x101/0x460 [scsimod] scsiscanchannel+0x179/0x1c0 [scsimod] scsiscanhostselected+0x259/0x2d0 [scsimod] storescan+0x2d2/0x390 [scsimod] devattrstore+0x43/0x80 sysfskfwrite+0xde/0x140 kernfsfopwriteiter+0x3ef/0x670 vfswrite+0x506/0x1470 ksyswrite+0xfd/0x230 x64syswrite+0x76/0xc0 x64syscall+0x213/0x1810 dosyscall64+0xee/0xfc0 entrySYSCALL64afterhwframe+0x4b/0x53

Freed by task 4314: kasansavestack+0x2a/0x50 kasansavetrack+0x18/0x40 kasansavefreeinfo+0x3f/0x50 kasanslabfree+0x67/0x80 kfree+0x225/0x6c0 scsitargetdevrelease+0x3d/0x60 [scsimod] devicerelease+0xa3/0x220 kobjectcleanup+0x105/0x3a0 kobjectput+0x72/0xd0 putdevice+0x17/0x20 scsidevicedevrelease+0xacf/0x12c0 [scsimod] devicerelease+0xa3/0x220 kobjectcleanup+0x105/0x3a0 kobjectput+0x72/0xd0 putdevice+0x17/0x20 scsideviceput+0x7f/0xc0 [scsimod] sdevstoredelete+0xa5/0x120 [scsimod] devattrstore+0x43/0x80 sysfskfwrite+0xde/0x140 kernfsfopwriteiter+0x3ef/0x670 vfswrite+0x506/0x1470 ksyswrite+0xfd/0x230 x64syswrite+0x76/0xc0 x64syscall+0x213/0x1810

Affected Software

12 affected components

Linux Linux kernel

Linux Linux kernel>=2.6.32<5.10.253

Linux Linux kernel>=5.11<5.15.203

Linux Linux kernel>=5.16<6.1.167

Linux Linux kernel>=6.2<6.6.130

Linux Linux kernel>=6.7<6.12.78

Linux Linux kernel>=6.13<6.18.20

Linux Linux kernel>=6.19<6.19.10

Linux Linux kernel=7.0-rc1

Linux Linux kernel=7.0-rc2

Linux Linux kernel=7.0-rc3

Linux Linux kernel=7.0-rc4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Fix the race condition related to device removal by inserting a flush_work() call in pm_runtime_remove().
pm_runtime_remove() insert flush_work() call = enabled

Event History

Apr 3, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

Description

Data Sourced

via NVD·04:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access and interaction does exploitation require?

The CVSS vector indicates local access and low privileges are required. No user interaction is required, but exploitation has high attack complexity.

What runtime condition triggers the issue?

The race occurs when runtime power-management work can access a device's parent while the parent device is being removed and has already been freed. This can lead to a use-after-free during asynchronous runtime PM processing.

How can administrators identify a possible occurrence?

A KASAN-enabled kernel may report a slab-use-after-free in lock_acquire, with pm_runtime_work, rpm_idle, and rpm_suspend in the call trace. The report was observed sporadically when running blktest block/001.

What does the fix do?

The fix adds a flush_work() call in pm_runtime_remove(). This ensures pending runtime PM work is completed before device removal proceeds and prevents it from dereferencing a freed parent device.

CVE-2026-23452: PM: runtime: Fix a race condition related to device removal

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access and interaction does exploitation require?

What runtime condition triggers the issue?

How can administrators identify a possible occurrence?

What does the fix do?

Company

Resources

Contact

Frequently Asked Questions

What level of access and interaction does exploitation require?

What runtime condition triggers the issue?

How can administrators identify a possible occurrence?

What does the fix do?