CVE-2026-93821: PCI: altera: Protect root bus removal with rescan lock
In the Linux kernel, the following vulnerability has been resolved:
PCI: altera: Protect root bus removal with rescan lock
Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.
[bhelgaas: commit log]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel PCI Altera root bus removal path, hold the pci_rescan_remove_lock while stopping and removing the root bus to prevent races with concurrent sysfs-triggered rescan or hotplug operations.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
A root PCI bus must be stopped or removed while a concurrent PCI rescan or hotplug operation is triggered through sysfs. The race can result in a use-after-free condition or a system crash.
Which systems are most exposed?
Systems using the Linux kernel PCI Altera driver and performing root-bus removal, PCI rescans, or PCI hotplug operations through sysfs are exposed to this race condition.
What can be done before a fix is applied?
Avoid concurrent sysfs-triggered PCI rescan or hotplug operations while stopping or removing a root PCI bus. Serializing these operations prevents the race described in the advisory.