CVE-2026-74331: firmware_loader: Fix recursive lock in device_cache_fw_images()
In the Linux kernel, the following vulnerability has been resolved:
firmwareloader: Fix recursive lock in devicecachefwimages()
A recursive locking deadlock can occur in the firmware loader's power management notification handler.
During system suspend or hibernation preparation, fwpmnotify() calls devicecachefwimages(). This function acquires fwlock to set the firmware cache state to FWLOADERSTARTCACHE and then iterates over all devices using dpmforeachdev() while still holding the lock.
For each device, devcachefwimage() schedules asynchronous work to cache the firmware. If memory allocation for the async work entry fails (e.g., in out-of-memory conditions), asyncschedulenodedomain() falls back to executing the work function synchronously in the current thread.
The synchronous execution path (asyncdevcachefwimage() -> cachefirmware() -> requestfirmware() -> assignfw()) attempts to acquire fwlock again. Since the current thread already holds fwlock, this results in a recursive locking deadlock.
Fix this by releasing fwlock immediately after updating the cache state and before calling dpmforeachdev(). The lock is only needed to protect the state update. Concurrent firmware requests will correctly see the FWLOADERSTARTCACHE state and use the piggyback mechanism, which is independently protected by its own fwc->namelock.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the firmware loader locking logic: after setting the cache firmware state to FW_LOADER_START_CACHE inside device_cache_fw_images(), release fw_lock immediately and only then call/iterate via dpm_for_each_dev() (avoid holding fw_lock while the synchronous execution path (__async_dev_cache_fw_image() -> cache_firmware() -> request_firmware() -> assign_fw()) attempts to reacquire fw_lock, which can cause a recursive locking deadlock).
firmware_loader (device_cache_fw_images/fw_pm_notify path) fw_lock release timing after cache state update = Release fw_lock immediately after updating the cache state to FW_LOADER_START_CACHE (before iterating devices via dpm_for_each_dev()/device_cache_fw_images).