CVE-2026-93819: PCI: mediatek: Protect root bus removal with rescan lock
In the Linux kernel, the following vulnerability has been resolved:
PCI: mediatek: Protect root bus removal with rescan lock
Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
[bhelgaas: commit log]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to prevent races with concurrent sysfs-triggered rescan or hotplug operations.
Linux kernel PCI MediaTek root bus removal pci_rescan_remove_lock = held while stopping and removing a root bus
Event History
Frequently Asked Questions
What conditions are required to trigger the race?
A root PCI bus must be stopped and removed while a concurrent PCI rescan or hotplug operation is occurring. The concurrent operations can be triggered through sysfs.
What is the likely impact if the race occurs?
The race can result in a use-after-free condition or a system crash.
How can I determine whether a system may be exposed?
Systems using the Linux kernel PCI Mediatek driver may be exposed when root-bus removal can occur concurrently with sysfs-triggered PCI rescan or hotplug operations.