CVE-2026-23452: PM: runtime: Fix a race condition related to device removal
In the Linux kernel, the following vulnerability has been resolved:
PM: runtime: Fix a race condition related to device removal
The following code in pmruntimework() may dereference the dev->parent pointer after the parent device has been freed:
/ Maybe the parent is now able to suspend. / if (parent && !parent->power.ignorechildren) { spinunlock(&dev->power.lock);
spinlock(&parent->power.lock); rpmidle(parent, RPMASYNC); spinunlock(&parent->power.lock);
spinlock(&dev->power.lock); }
Fix this by inserting a flushwork() call in pmruntimeremove().
Without this patch blktest block/001 triggers the following complaint sporadically:
BUG: KASAN: slab-use-after-free in lockacquire+0x70/0x160 Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081 Workqueue: pm pmruntimework Call Trace: <TASK> dumpstacklvl+0x61/0x80 printaddressdescription.constprop.0+0x8b/0x310 printreport+0xfd/0x1d7 kasanreport+0xd8/0x1d0 kasancheckbyte+0x42/0x60 lockacquire.part.0+0x38/0x230 lockacquire+0x70/0x160 rawspinlock+0x36/0x50 rpmsuspend+0xc6a/0xfe0 rpmidle+0x578/0x770 pmruntimework+0xee/0x120 processonework+0xde3/0x1410 workerthread+0x5eb/0xfe0 kthread+0x37b/0x480 retfromfork+0x6cb/0x920 retfromforkasm+0x11/0x20 </TASK>
Allocated by task 4314: kasansavestack+0x2a/0x50 kasansavetrack+0x18/0x40 kasansaveallocinfo+0x3d/0x50 kasankmalloc+0xa0/0xb0 kmallocnoprof+0x311/0x990 scsialloctarget+0x122/0xb60 [scsimod] scsiscantarget+0x101/0x460 [scsimod] scsiscanchannel+0x179/0x1c0 [scsimod] scsiscanhostselected+0x259/0x2d0 [scsimod] storescan+0x2d2/0x390 [scsimod] devattrstore+0x43/0x80 sysfskfwrite+0xde/0x140 kernfsfopwriteiter+0x3ef/0x670 vfswrite+0x506/0x1470 ksyswrite+0xfd/0x230 x64syswrite+0x76/0xc0 x64syscall+0x213/0x1810 dosyscall64+0xee/0xfc0 entrySYSCALL64afterhwframe+0x4b/0x53
Freed by task 4314: kasansavestack+0x2a/0x50 kasansavetrack+0x18/0x40 kasansavefreeinfo+0x3f/0x50 kasanslabfree+0x67/0x80 kfree+0x225/0x6c0 scsitargetdevrelease+0x3d/0x60 [scsimod] devicerelease+0xa3/0x220 kobjectcleanup+0x105/0x3a0 kobjectput+0x72/0xd0 putdevice+0x17/0x20 scsidevicedevrelease+0xacf/0x12c0 [scsimod] devicerelease+0xa3/0x220 kobjectcleanup+0x105/0x3a0 kobjectput+0x72/0xd0 putdevice+0x17/0x20 scsideviceput+0x7f/0xc0 [scsimod] sdevstoredelete+0xa5/0x120 [scsimod] devattrstore+0x43/0x80 sysfskfwrite+0xde/0x140 kernfsfopwriteiter+0x3ef/0x670 vfswrite+0x506/0x1470 ksyswrite+0xfd/0x230 x64syswrite+0x76/0xc0 x64syscall+0x213/0x1810
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel power-management runtime removal path, insert a flush_work() call in pm_runtime_remove() to prevent pm_runtime_work() from dereferencing dev->parent after the parent device has been freed.
Event History
Frequently Asked Questions
What level of access and interaction does exploitation require?
The CVSS vector indicates local access and low privileges are required. No user interaction is required, but exploitation has high attack complexity.
What runtime condition triggers the issue?
The race occurs when runtime power-management work can access a device's parent while the parent device is being removed and has already been freed. This can lead to a use-after-free during asynchronous runtime PM processing.
How can administrators identify a possible occurrence?
A KASAN-enabled kernel may report a slab-use-after-free in lock_acquire, with pm_runtime_work, rpm_idle, and rpm_suspend in the call trace. The report was observed sporadically when running blktest block/001.
What does the fix do?
The fix adds a flush_work() call in pm_runtime_remove(). This ensures pending runtime PM work is completed before device removal proceeds and prevents it from dereferencing a freed parent device.