CVE-2026-97948
Received Received - Intake

Recursive Locking in Linux Kernel EEH Subsystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 ("powerpc/eeh: Make EEH driver device hotplug safe") refactored the EEH code such that the pci_rescan_remove_lock is held at the beginning of eeh_handle_normal_event() and the eeh_reset_device() is called with that lock being held. Looks like the commit missed to remove the existing lock/unlock inside eeh_rmv_device() which is no longer necessary. This is causing the eehd to hang on the lock which it actually holds when that code path is taken. [<0>] 0xc00000011c78f870 [<0>] __switch_to+0xfc/0x1a0 [<0>] pci_lock_rescan_remove+0x30/0x44 [<0>] eeh_rmv_device+0x290/0x2e0 [<0>] eeh_pe_dev_traverse+0x80/0x130 [<0>] eeh_reset_device+0xcc/0x23c [<0>] eeh_handle_normal_event+0x830/0xa80 [<0>] eeh_event_handler+0xf8/0x190 [<0>] kthread+0x194/0x1b0 [<0>] start_kernel_thread+0x14/0x18 The issue is seen for cases where the errors are detected on the PHB directly AND|OR for devices where the driver error_detected() returns PCI_ERS_RESULT_NEED_RESET, and driver being not EEH sensitive(i.e no error handlers like slot_reset(), resume() etc defined).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97948
EUVD
EUVD-2026-86802

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a recursive locking issue in the powerpc/eeh (Enhanced Error Handling) subsystem. A recent code change made the pci_rescan_remove_lock be held at the start of eeh_handle_normal_event(), but failed to remove an existing lock/unlock inside eeh_rmv_device(). This causes the system to hang when the lock is already held during certain error handling paths, particularly when errors are detected on the PCI Host Bridge (PHB) directly or when non-EEH sensitive drivers return PCI_ERS_RESULT_NEED_RESET.

Detection Guidance

This vulnerability is specific to the Linux kernel's powerpc/eeh subsystem and may cause system hangs due to recursive locking. Detection involves checking kernel logs for EEH-related errors or hangs during PCI device resets. Monitor dmesg for messages like 'eeh_rmv_device' or 'pci_lock_rescan_remove' and verify if the system hangs during PCI error handling.

Impact Analysis

This vulnerability can cause the Linux system to hang or become unresponsive during PCI device error handling. If you are running a Linux system with powerpc architecture and encounter PCI errors, the system may freeze when attempting to reset or remove affected devices, leading to potential service disruption or downtime.

Mitigation Strategies

Apply the kernel patch referenced in the CVE description (commit 1010b4c012b0). Update to a Linux kernel version that includes this fix. If immediate patching is not possible, avoid triggering PCI error handling paths on powerpc systems until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97948. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart