CVE-2024-26605 is a vulnerability identified in the Linux kernel related to the PCI Express Active State Power Management (ASPM) feature, specifically when enabling ASPM on Qualcomm PCIe controllers. The issue was introduced by a last-minute revert in the Linux kernel version 6.7-final, which caused a potential deadlock scenario during the asynchronous probe phase of PCIe device initialization. The deadlock arises due to recursive locking of the pci_bus_sem semaphore: a thread attempts to acquire a read lock on pci_bus_sem while already holding a write lock on the same semaphore. This unsafe locking pattern leads to a deadlock condition, as demonstrated by kernel lock dependency (lockdep) warnings and call traces involving functions such as pcie_aspm_pm_state_change, pci_set_power_state, and qcom_pcie_enable_aspm. The deadlock can be reliably reproduced on hardware like the Lenovo ThinkPad X13s by artificially increasing the race window during asynchronous probing. The root cause is the lack of a dedicated function to handle power state changes while the PCI bus semaphore is already held, which was addressed by introducing pci_set_power_state_locked() and related helper functions to avoid double locking. This vulnerability affects multiple Linux kernel commits identified by their hashes, indicating it impacts recent kernel versions prior to the fix. No known exploits are reported in the wild at this time.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions on hardware utilizing Qualcomm PCIe controllers, including laptops and servers. The deadlock can cause system hangs or kernel stalls during device initialization or power state transitions, potentially leading to denial of service conditions. This can disrupt critical services, especially in environments relying on Linux-based infrastructure for networking, cloud computing, or embedded systems. The impact on confidentiality and integrity is minimal as the vulnerability is a deadlock rather than a code execution or privilege escalation flaw. However, availability is significantly affected since the deadlock can freeze kernel operations related to PCIe device management. Organizations with high availability requirements or those operating in sectors like finance, healthcare, or industrial control in Europe could experience operational disruptions. Additionally, the vulnerability may complicate system maintenance and updates, increasing downtime risk.

European organizations should promptly update their Linux kernels to versions that include the fix for CVE-2024-26605. Specifically, they should apply patches that introduce pci_set_power_state_locked() and related helper functions to prevent recursive locking. For systems where immediate kernel upgrades are not feasible, administrators can consider disabling ASPM on Qualcomm PCIe controllers as a temporary workaround, though this may impact power efficiency. Monitoring kernel logs for lockdep warnings related to pci_bus_sem can help detect attempts to trigger the deadlock. Organizations should also test kernel updates in staging environments with hardware representative of production to ensure stability. For custom or embedded Linux distributions, maintainers must integrate the patch into their kernel builds. Finally, coordinating with hardware vendors to confirm compatibility and support for patched kernels is advisable to avoid regressions.