CVE-2026-23452
Use-After-Free Race Condition in Linux Kernel PM Runtime Device Removal
Publication date: 2026-04-03
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to access memory that has already been freed, leading to undefined behavior such as system crashes or kernel panics.
Such use-after-free errors can destabilize the system, potentially causing denial of service or other reliability issues.
While the description does not explicitly mention exploitation for privilege escalation or code execution, memory corruption vulnerabilities in the kernel can sometimes be leveraged by attackers to compromise system security.
Can you explain this vulnerability to me?
This vulnerability is a race condition in the Linux kernel's power management runtime code related to device removal.
Specifically, the function pm_runtime_work() may dereference a device's parent pointer after the parent device has already been freed, which can lead to a use-after-free error.
This happens because the code does not properly synchronize the removal of devices, allowing the parent device to be accessed after it has been released.
The issue is fixed by inserting a flush_work() call in pm_runtime_remove() to ensure proper synchronization and prevent accessing freed memory.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a race condition in the Linux kernel's power management runtime code that may cause use-after-free errors. Detection would typically involve monitoring kernel logs for related error messages.
You can check your system logs for kernel BUG or KASAN (Kernel Address Sanitizer) reports indicating use-after-free errors related to pm_runtime_work or device removal.
- Use the command: dmesg | grep -i 'KASAN' to look for KASAN slab-use-after-free errors.
- Use the command: journalctl -k | grep -i 'pm_runtime_work' to find kernel messages related to the vulnerable function.
- Monitor for BUG messages in kernel logs with: dmesg | grep -i 'BUG'
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by a patch that inserts a flush_work() call in the pm_runtime_remove() function to prevent the race condition.
Immediate mitigation steps include updating your Linux kernel to a version that contains this fix.
If updating the kernel is not immediately possible, consider minimizing device removal operations or runtime power management activities that could trigger this race condition.