PM: runtime: Fix a race condition related to device removal
In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has been freed: /* Maybe the parent is now able to suspend. */ if (parent && !parent->power.ignore_children) { spin_unlock(&dev->power.lock); spin_lock(&parent->power.lock); rpm_idle(parent, RPM_ASYNC); spin_unlock(&parent->power.lock); spin_lock(&dev->power.lock); } Fix this by inserting a flush_work() call in pm_runtime_remove(). Without this patch blktest block/001 triggers the following complaint sporadically: BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160 Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081 Workqueue: pm pm_runtime_work Call Trace: dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x8b/0x310 print_report+0xfd/0x1d7 kasan_report+0xd8/0x1d0 __kasan_check_byte+0x42/0x60 lock_acquire.part.0+0x38/0x230 lock_acquire+0x70/0x160 _raw_spin_lock+0x36/0x50 rpm_suspend+0xc6a/0xfe0 rpm_idle+0x578/0x770 pm_runtime_work+0xee/0x120 process_one_work+0xde3/0x1410 worker_thread+0x5eb/0xfe0 kthread+0x37b/0x480 ret_from_fork+0x6cb/0x920 ret_from_fork_asm+0x11/0x20 Allocated by task 4314: kasan_save_stack+0x2a/0x50 kasan_save_track+0x18/0x40 kasan_save_alloc_info+0x3d/0x50 __kasan_kmalloc+0xa0/0xb0 __kmalloc_noprof+0x311/0x990 scsi_alloc_target+0x122/0xb60 [scsi_mod] __scsi_scan_target+0x101/0x460 [scsi_mod]
CVE-2026-23452
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-23452
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "20f6e2e22a9c6234113812d5f300d3e952a82721",
"versionType": "git"
},
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "b6dd1a562ca8ba96c8ecb247c62b73f9fa02d47e",
"versionType": "git"
},
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "5649b46af8b167259e8a8e4e7eb3667ce74554b5",
"versionType": "git"
},
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "39f2d86f2ddde8d1beda05732f30c7cd945e0b5a",
"versionType": "git"
},
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "c6febaacfb8a0aec7d771a0e6c21cd68102d5679",
"versionType": "git"
},
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "bb081fd37f8312651140d7429557258afe51693d",
"versionType": "git"
},
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "cf65a77c0f9531eb6cfb97cc040974d2d8fff043",
"versionType": "git"
},
{
"status": "affected",
"version": "5e928f77a09a07f9dd595bb8a489965d69a83458",
"lessThan": "29ab768277617452d88c0607c9299cdc63b6e9ff",
"versionType": "git"
}
],
"programFiles": [
"drivers/base/power/runtime.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.32",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/base/power/runtime.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-23452
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #27258 · Revision 1
- Added to Heist Feed
- Publisher date