CVE-2024-26605

PCI/ASPM: Fix deadlock when enabling ASPM

MEDIUM
5.5
CVSS Score
Published: February 24, 2024 at 03:17 PM UTC
Updated: June 17, 2026 at 07:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep: ============================================ WARNING: possible recursive locking detected 6.7.0 #40 Not tainted -------------------------------------------- kworker/u16:5/90 is trying to acquire lock: ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pcie_aspm_pm_state_change+0x58/0xdc but task is already holding lock: ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pci_walk_bus+0x34/0xbc other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(pci_bus_sem); lock(pci_bus_sem); *** DEADLOCK *** Call trace: print_deadlock_bug+0x25c/0x348 __lock_acquire+0x10a4/0x2064 lock_acquire+0x1e8/0x318 down_read+0x60/0x184 pcie_aspm_pm_state_change+0x58/0xdc pci_set_full_power_state+0xa8/0x114 pci_set_power_state+0xc4/0x120 qcom_pcie_enable_aspm+0x1c/0x3c [pcie_qcom] pci_walk_bus+0x64/0xbc qcom_pcie_host_post_init_2_7_0+0x28/0x34 [pcie_qcom] The deadlock can easily be reproduced on machines like the Lenovo ThinkPad X13s by adding a delay to increase the race window during asynchronous probe where another thread can take a write lock. Add a new pci_set_power_state_locked() and associated helper functions that can be called with the PCI bus semaphore held to avoid taking the read lock twice.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 5.15.1475.15.147 ≤ v < 5.166.1.72 ≤ v < 6.1.886.6.11 ≤ v < 6.6.296.7 ≤ v < 6.7.56.7 ≤ v < 6.81f2f662c8bec75d1311e063efaa9107435cf16c85.15.1476.1.726.6.116.78cc22ba3f77c59df5f1ac47d62df51efb28cd868b9c370b61d735a0e5390c42771e7eb21413f7868f93e71aea6c60ebff8adbd8941e678302d377869
Vendor states this is fixed in 0f7908a016c092cfdaa16d785fa5099d867bc1a3 (fixed)
Vendor states this is fixed in 1e560864159d002b453da42bd2c13a1805515a20 (fixed)
Vendor states this is fixed in b0f4478838be1f1d330061201898fef65bf8fd7c (fixed)
Vendor states this is fixed in ef90508574d7af48420bdc5f7b9a4f1cdd26bc70 (fixed)
Affected range stops below 5.16, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.1.88 (unaffected)
Vendor states this is fixed in 6.6.29 (unaffected)
Vendor states this is fixed in 6.7 (unaffected)
Vendor states this is fixed in 6.7.5 (unaffected)
Vendor states this is fixed in 6.8 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

References (4)

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card