« Volver al listado

CVE-2026-74331

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: Fix recursive lock in device_cache_fw_images()

A recursive locking deadlock can occur in the firmware loader's power management notification handler.

During system suspend or hibernation preparation, fw_pm_notify() calls device_cache_fw_images(). This function acquires fw_lock to set the firmware cache state to FW_LOADER_START_CACHE and then iterates over all devices using dpm_for_each_dev() while still holding the lock.

For each device, dev_cache_fw_image() schedules asynchronous work to cache the firmware.

Leer descripción completaMostrar menos

If memory allocation for the async work entry fails (e.g., in out-of-memory conditions), async_schedule_node_domain() falls back to executing the work function synchronously in the current thread.

The synchronous execution path (__async_dev_cache_fw_image() -> cache_firmware() -> request_firmware() -> assign_fw()) attempts to acquire fw_lock again. Since the current thread already holds fw_lock, this results in a recursive locking deadlock.

Fix this by releasing fw_lock immediately after updating the cache state and before calling dpm_for_each_dev(). The lock is only needed to protect the state update. Concurrent firmware requests will correctly see the FW_LOADER_START_CACHE state and use the piggyback mechanism, which is independently protected by its own fwc->name_lock.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74331",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "806cb8fabfde7f830da5ae87777d52fdf50c4774",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "7865a1bfd20d10c03b083a5fc392d907ca5099b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "490b0385e4cfac691f7b18dde821c13e77b4770b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "38149b57427c736c08d9aa4c7b87deacd53e9e63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "a5b2a68a391b05d54552f13548a72a46c65006f7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "f25d6e4ec4c257030592bd671f113cf9584c52f0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "c0f2dedd41fe14dbe076c1672214802fb42cd8c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "lessThan": "d3ec78f8f8d48a04a9fac38d47275c34645e5103",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:33.907",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/38149b57427c736c08d9aa4c7b87deacd53e9e63",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/490b0385e4cfac691f7b18dde821c13e77b4770b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7865a1bfd20d10c03b083a5fc392d907ca5099b3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/806cb8fabfde7f830da5ae87777d52fdf50c4774",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a5b2a68a391b05d54552f13548a72a46c65006f7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c0f2dedd41fe14dbe076c1672214802fb42cd8c8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3ec78f8f8d48a04a9fac38d47275c34645e5103",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f25d6e4ec4c257030592bd671f113cf9584c52f0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Fix recursive lock in device_cache_fw_images()\n\nA recursive locking deadlock can occur in the firmware loader's power\nmanagement notification handler.\n\nDuring system suspend or hibernation preparation, fw_pm_notify() calls\ndevice_cache_fw_images(). This function acquires fw_lock to set the\nfirmware cache state to FW_LOADER_START_CACHE and then iterates over all\ndevices using dpm_for_each_dev() while still holding the lock.\n\nFor each device, dev_cache_fw_image() schedules asynchronous work to cache\nthe firmware. If memory allocation for the async work entry fails (e.g., in\nout-of-memory conditions), async_schedule_node_domain() falls back to\nexecuting the work function synchronously in the current thread.\n\nThe synchronous execution path (__async_dev_cache_fw_image() ->\ncache_firmware() -> request_firmware() -> assign_fw()) attempts to acquire\nfw_lock again. Since the current thread already holds fw_lock, this results\nin a recursive locking deadlock.\n\nFix this by releasing fw_lock immediately after updating the cache state\nand before calling dpm_for_each_dev(). The lock is only needed to protect\nthe state update. Concurrent firmware requests will correctly see the\nFW_LOADER_START_CACHE state and use the piggyback mechanism, which is\nindependently protected by its own fwc->name_lock."
    }
  ],
  "lastModified": "2026-08-17T06:19:27.560",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}