VulnerabilityPublished 27 May 2026Updated 6 Nov 2026

CVE-2026-45904: Linux kernel · powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f49faa4a64f8ac0e38983e606075b25dfcfc9ad4 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f49faa4a64f8ac0e38983e606075b25dfcfc9ad4, f8b16d5764ee1e78c1ef333017ad383ffe76fcdc, b85ee287bfe52c6b2d9b41758b5e0d08679d5b39 +12

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.10.241 <5.10.252 >=5.15.190 <5.15.202 >=6.1.148 <6.1.165 >=6.6.102 <6.6.128 >=6.12.42 <6.12.75 >=6.15.10 <6.16 >=6.16.1 <6.17	Fixed in f49faa4a64f8ac0e38983e606075b25dfcfc9ad4 f8b16d5764ee1e78c1ef333017ad383ffe76fcdc b85ee287bfe52c6b2d9b41758b5e0d08679d5b39 89810e2d80281d42f855fac813786758ee16e323 815a8d2feb5615ae7f0b5befd206af0b0160614c 788dd28fd49610d6047cbb15dbf1186afffdfbaf 87a1f93986aa1500b85aeff16b0b71c29ea116ea 6e6561231c6cfc32c5631aeecc0928ff2b14265c 6.17 6.16 6.12.75 6.6.128 6.1.165 5.15.202 5.10.252
LinuxLinux	Affected =6.17	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 6.17 and 6.16, as well as several stable branches (>=5.10.241 <5.10.252, >=5.15.190 <5.15.202, >=6.1.148 <6.1.165, >=6.6.102 <6.6.128, >=6.12.42 <6.12.75, >=6.15.10 <6.16, >=6.16.1 <6.17). Users and administrators should update to these fixed versions to resolve the recursive locking issue and restore proper PCI error handling. No additional mitigations are indicated by the vendor advisory.

Description

CVE-2026-45904 addresses a locking issue in the Linux kernel's powerpc EEH driver where recursive acquisition of pci_lock_rescan_remove caused deadlocks and disrupted PCI error handling. The fix restructures locking calls to avoid recursive lock acquisition by introducing a no-lock variant of eeh_pe_bus_get and restoring pci_lock_rescan_remove calls to their correct positions. This resolves deadlock warnings and ensures proper PCI error event handling.

Impact

The vulnerability caused recursive locking of pci_lock_rescan_remove() in the EEH event handling path, leading to deadlocks and broken PCI error reporting on affected Linux kernel versions. This could disrupt proper PCI error event triggering and handling, potentially impacting system stability and error recovery on powerpc platforms using EEH.

Summary

This vulnerability in the Linux kernel's powerpc EEH driver was introduced by a recent commit that moved pci_lock_rescan_remove() outside its intended scope in eeh_handle_normal_event(), causing recursive locking when eeh_pe_bus_get() internally attempted to acquire the same lock. This recursive locking led to deadlocks and broken PCI error reporting. The patch adds a boolean parameter to _eeh_pe_bus_get() to control locking, provides a no-lock wrapper for callers already holding the lock, and repositions pci_lock_rescan_remove() calls to avoid recursive lock acquisition. Additionally, eeh_pe_loc_get() was split into two functions to improve code clarity. The fix eliminates lockdep warnings and deadlocks related to pci_rescan_remove_lock in affected Linux kernel versions.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:05 UTC

Technical details

References

Community reviews

Related threats