CVE-2026-93818: PCI: plda: Protect root bus removal with rescan lock
In the Linux kernel, the following vulnerability has been resolved:
PCI: plda: Protect root bus removal with rescan lock
Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
[bhelgaas: commit log]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to prevent races with concurrent sysfs-triggered rescan or hotplug operations.
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The race requires root bus removal to overlap with a PCI rescan or hotplug operation initiated through sysfs. The concurrent operations can cause use-after-free conditions or a system crash.
Which systems are most relevant to triage?
Systems using the Linux kernel PCI PLDA driver are relevant, particularly where root-bus removal and sysfs-triggered PCI rescan or hotplug operations may occur concurrently.
What is the mitigation if the fix cannot be deployed immediately?
Avoid concurrent sysfs-triggered PCI rescan or hotplug operations while a PCI root bus is being stopped or removed. The resolved issue is addressed by holding the PCI rescan/remove lock during root-bus removal.