CVE-2026-90421: PCI: Fix UAF when probe runs concurrent to dyn ID removal
In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix UAF when probe runs concurrent to dyn ID removal
Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as removeidstore() can free the node. Thus, make a copy in pcimatchdevice(). Also, clarify that the id parameter is only valid during probe.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The race requires a PCI driver probe to run concurrently with removal of a dynamic device ID. The affected code path involves dynamic IDs whose backing node can be freed by remove_id_store().
What is the immediate mitigation if the fix cannot be deployed?
Avoid removing dynamic PCI device IDs while driver probe operations may be running. This reduces exposure to the concurrent access that can free a dynamic-ID node during matching.
How can I determine whether a system is exposed to this race?
Review whether the system uses PCI dynamic IDs and permits dynamic-ID removal through remove_id_store() while devices may be probed. Systems that do not exercise concurrent dynamic-ID removal and probing do not meet the described trigger conditions.