CVE-2026-97948: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
In the Linux kernel, the following vulnerability has been resolved:
powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
The commit 1010b4c012b0 ("powerpc/eeh: Make EEH driver device hotplug safe") refactored the EEH code such that the pcirescanremovelock is held at the beginning of eehhandlenormalevent() and the eehresetdevice() is called with that lock being held. Looks like the commit missed to remove the existing lock/unlock inside eehrmvdevice() which is no longer necessary. This is causing the eehd to hang on the lock which it actually holds when that code path is taken.
[<0>] 0xc00000011c78f870 [<0>] switchto+0xfc/0x1a0 [<0>] pcilockrescanremove+0x30/0x44 [<0>] eehrmvdevice+0x290/0x2e0 [<0>] eehpedevtraverse+0x80/0x130 [<0>] eehresetdevice+0xcc/0x23c [<0>] eehhandlenormalevent+0x830/0xa80 [<0>] eeheventhandler+0xf8/0x190 [<0>] kthread+0x194/0x1b0 [<0>] startkernelthread+0x14/0x18
The issue is seen for cases where the errors are detected on the PHB directly AND|OR for devices where the driver errordetected() returns PCIERSRESULTNEEDRESET, and driver being not EEH sensitive(i.e no error handlers like slotreset(), resume() etc defined).
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the hang condition?
The affected path is in the Linux kernel powerpc EEH error-handling code. It is seen when errors are detected directly on the PHB, or when a device driver's error_detected() callback returns PCI_ERS_RESULT_NEED_RESET and that driver is not EEH-sensitive.
What driver behavior makes the problem more likely to occur?
The described case requires a driver without EEH error handlers such as slot_reset() and resume(). If that driver requests a reset through PCI_ERS_RESULT_NEED_RESET, EEH can enter the affected removal path.
How can I recognize an affected system?
The EEH daemon, eehd, can hang while waiting on pci_rescan_remove_lock that it already holds. A kernel stack trace may show pci_lock_rescan_remove(), eeh_rmv_device(), eeh_reset_device(), eeh_handle_normal_event(), and eeh_event_handler().