Skip to main content

Linux Kernel EUVDEUVD-2026-32370

| CVE-2026-45904 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5f94-f58j-vgqv
Information Disclosure Linux IBM Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privilege access on IBM POWER system
  2. Delivery
    Wait for or induce PCI EEH error event
  3. Exploit
    eeh_handle_normal_event() acquires pci_rescan_remove_lock
  4. Execution
    eeh_pe_bus_get() internally re-acquires same mutex
  5. Persist
    Recursive deadlock detected by lockdep, EEH daemon hangs
  6. Impact
    PCI error recovery permanently disabled for kernel session

Vulnerability Assessment

Weakness
CWE
CWE-674
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
Exploitation Conditions

Exploitation requires a local, low-privileged user session (AV:L/PR:L per CVSS) on an IBM PowerPC or POWER system where the Linux EEH subsystem is active - EEH is enabled by default on supported IBM POWER hardware and is not a non-default configuration. The deadlock is triggered when the EEH daemon processes a normal EEH event (eeh_handle_normal_event()) on an affected kernel version, which occurs automatically upon PCI hardware errors or during PCI hotplug operations; a low-privilege user does not need to directly invoke the EEH path but must be present on an affected system where such events occur naturally. Systems not based on IBM PowerPC/POWER architecture are entirely unaffected regardless of kernel version. The condition is further limited to kernel versions introduced after commit 1010b4c012b0 and prior to the stable backport fixes; unpatched kernels in this range on IBM POWER hardware are vulnerable whenever a PCI EEH event fires.
Impact

The NVD CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: exploitation is strictly local, requires low privileges, and produces only an availability impact. EPSS at 0.02% (7th percentile) is consistent with the extremely narrow affected hardware population - only IBM POWER systems (e.g., POWER10) running Linux with EEH active are impacted. The vulnerability is not listed in CISA KEV and no POC or exploit code has been identified. The 'Information Disclosure' tag in the input data conflicts with the CVSS vector's C:N rating and the description, which describes no data exposure - this tag appears to be a mislabel and should not influence risk decisions. The primary real-world risk is EEH daemon deadlock during PCI error events, which would prevent hardware fault recovery on IBM POWER infrastructure; this is a high-severity operational reliability concern for IBM POWER operators but is not a meaningful attack vector for general Linux environments. Low EPSS and hardware specificity make this a low-priority item outside IBM POWER fleets.
Exploit ScenarioDerived

An authenticated local user on an IBM POWER server (e.g., a co-tenant in a virtualized POWER10 environment) waits for or induces a PCI error event - such as a transient hardware fault or a PCI hotplug operation - causing the kernel's eehd daemon to enter eeh_handle_normal_event(). The daemon acquires pci_rescan_remove_lock and then calls eeh_pe_bus_get(), which attempts to re-acquire the same non-reentrant mutex, triggering a deadlock that permanently hangs the EEH subsystem and disables all subsequent PCI error recovery for the lifetime of the kernel session. No public exploit code has been identified; the scenario is more likely to manifest as an inadvertent reliability failure than a deliberate attack.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 24, 2026

Recursive mutex deadlock in the Linux kernel's PowerPC Enhanced Error Handling (EEH) subsystem causes denial of service on IBM POWER systems running affected kernel versions. Commit 1010b4c012b0 inadvertently repositioned pci_lock_rescan_remove() calls so that eeh_handle_normal_event() holds the lock before invoking eeh_pe_bus_get(), which internally attempts to acquire the same mutex, producing a confirmed lockdep-detected deadlock that crashes the EEH daemon and disables PCI error recovery. No public exploit has been identified and the EPSS score of 0.02% (7th percentile) reflects the narrow hardware-specific attack surface; real-world impact is a reliability and availability concern for IBM POWER server operators rather than a traditional security attack vector.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, or 6.19.4, each containing the relevant backport commits available at https://git.kernel.org/stable/c/6e6561231c6cfc32c5631aeecc0928ff2b14265c and the seven companion stable commits listed in the references. Distribution maintainers targeting IBM POWER (Red Hat, SUSE, Canonical, IBM's own kernel packages) should be monitored for corresponding package updates. As a temporary compensating control on non-critical systems only, adding eeh=off to the kernel boot parameters via GRUB will prevent the EEH daemon from processing events and avoid the deadlock; however, this entirely disables PCI hardware error recovery, eliminating fault tolerance on IBM POWER hardware and is strongly discouraged for production systems where reliability is required. No workaround preserves EEH functionality while mitigating the deadlock prior to patching.

Affected VersionsENISA

Linux 6.16.1 <6.17
Linux patch: 5.15.202
Linux 502f08831a9afb72dc98a56ae6504da43e93b250 <89810e2d80281d42f855fac813786758ee16e323
Linux patch: 7.0
Linux 5.15.190 <5.15.202
Linux f56e004b781719d8fdf6c9619b15caf2579bc1f2 <788dd28fd49610d6047cbb15dbf1186afffdfbaf
Linux patch: 6.1.165
Linux 6.17
Linux patch: 5.10.252
Linux d42bbd8f30ac38b1ce54715bf08ec3dac18d6b25
Linux 6.1.148 <6.1.165
Linux 6.12.42 <6.12.75
Linux 6.15.10 <6.16
Linux patch: 6.12.75
Linux 1010b4c012b0d78dfb9d3132b49aa2ef024a07a7 <b85ee287bfe52c6b2d9b41758b5e0d08679d5b39
Linux patch: 0
Linux d2c60a8a387e9fcc28447ef36c03f8e49fd052a6 <f8b16d5764ee1e78c1ef333017ad383ffe76fcdc
Linux patch: 6.19.4
Linux 1010b4c012b0d78dfb9d3132b49aa2ef024a07a7 <6e6561231c6cfc32c5631aeecc0928ff2b14265c
Linux patch: 6.18.14
Linux 59c6d3d81d42bf543c90597b4f38c53d6874c5a1 <f49faa4a64f8ac0e38983e606075b25dfcfc9ad4
Linux 19d5036e7ad766cf212aebec23b9f1d7924a62bc
Linux 6.6.102 <6.6.128
Linux a426e8a6ae161f51888585b065db0f8f93ab2e16 <87a1f93986aa1500b85aeff16b0b71c29ea116ea
Linux 5.10.241 <5.10.252
Linux 1010b4c012b0d78dfb9d3132b49aa2ef024a07a7 <815a8d2feb5615ae7f0b5befd206af0b0160614c
Linux patch: 6.6.128

Affected Packages

euvd linux fix: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.16, 6.17

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The EEH (Enhanced Error Handling) subsystem in the Linux kernel provides hardware-assisted PCI bus error detection and recovery on IBM PowerPC and POWER platforms. The affected synchronization primitive is pci_rescan_remove_lock, a mutex shared between PCI hotplug and EEH event processing paths. A prior refactor (commit 1010b4c012b0, 'Make EEH driver device hotplug safe') moved the pci_lock_rescan_remove() acquisition to a scope encompassing the eeh_pe_bus_get() call, which itself calls pci_lock_rescan_remove() internally - producing a non-reentrant recursive mutex acquisition. CWE-674 (Incorrect Control Flow Scoping) captures this pattern precisely: a synchronization primitive is placed in the wrong lexical scope, creating a call-graph-level double-acquisition. The fix introduces eeh_pe_bus_get_nolock() for call sites that already hold the lock and restores the lock acquisition to immediately before PE/device iteration. Affected CPE is cpe:2.3:o:linux:linux_kernel:* across eight stable branches as confirmed by kernel.org stable commit references.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local access with low privileges needed to be present when EEH events fire; deadlock impacts only availability with zero data exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 24, 2026 - 16:37 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling

The recent commit 1010b4c012b0 ("powerpc/eeh: Make EEH driver device hotplug safe") restructured the EEH driver to improve synchronization with the PCI hotplug layer.

However, it inadvertently moved pci_lock_rescan_remove() outside its intended scope in eeh_handle_normal_event(), leading to broken PCI error reporting and improper EEH event triggering. Specifically, eeh_handle_normal_event() acquired pci_lock_rescan_remove() before calling eeh_pe_bus_get(), but eeh_pe_bus_get() itself attempts to acquire the same lock internally, causing nested locking and disrupting normal EEH event handling paths.

This patch adds a boolean parameter do_lock to _eeh_pe_bus_get(), with two public wrappers: eeh_pe_bus_get() with locking enabled. eeh_pe_bus_get_nolock() that skips locking.

Callers that already hold pci_lock_rescan_remove() now use eeh_pe_bus_get_nolock() to avoid recursive lock acquisition.

Additionally, pci_lock_rescan_remove() calls are restored to the correct position-after eeh_pe_bus_get() and immediately before iterating affected PEs and devices. This ensures EEH-triggered PCI removes occur under proper bus rescan locking without recursive lock contention.

The eeh_pe_loc_get() function has been split into two functions: eeh_pe_loc_get(struct eeh_pe *pe) which retrieves the loc for given PE. eeh_pe_loc_get_bus(struct pci_bus *bus) which retrieves the location code for given bus.

This resolves lockdep warnings such as: <snip> [ 84.964298] [ T928] ============ [ 84.964304] [ T928] WARNING: possible recursive locking detected [ 84.964311] [ T928] 6.18.0-rc3 #51 Not tainted [ 84.964315] [ T928] -------------------------------------------- [ 84.964320] [ T928] eehd/928 is trying to acquire lock: [ 84.964324] [ T928] c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40 [ 84.964342] [ T928] but task is already holding lock: [ 84.964347] [ T928] c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40 [ 84.964357] [ T928] other info that might help us debug this: [ 84.964363] [ T928] Possible unsafe locking scenario:

[ 84.964367] [ T928] CPU0 [ 84.964370] [ T928] ---- [ 84.964373] [ T928] lock(pci_rescan_remove_lock); [ 84.964378] [ T928] lock(pci_rescan_remove_lock); [ 84.964383] [ T928] * DEADLOCK *

[ 84.964388] [ T928] May be due to missing lock nesting notation

[ 84.964393] [ T928] 1 lock held by eehd/928: [ 84.964397] [ T928] #0: c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40 [ 84.964408] [ T928] stack backtrace: [ 84.964414] [ T928] CPU: 2 UID: 0 PID: 928 Comm: eehd Not tainted 6.18.0-rc3 #51 VOLUNTARY [ 84.964417] [ T928] Hardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_022) hv:phyp pSeries [ 84.964419] [ T928] Call Trace: [ 84.964420] [ T928] [c0000011a7157990] [c000000001705de4] dump_stack_lvl+0xc8/0x130 (unreliable) [ 84.964424] [ T928] [c0000011a71579d0] [c0000000002f66e0] print_deadlock_bug+0x430/0x440 [ 84.964428] [ T928] [c0000011a7157a70] [c0000000002fd0c0] __lock_acquire+0x1530/0x2d80 [ 84.964431] [ T928] [c0000011a7157ba0] [c0000000002fea54] lock_acquire+0x144/0x410 [ 84.964433] [ T928] [c0000011a7157cb0] [c0000011a7157cb0] __mutex_lock+0xf4/0x1050 [ 84.964436] [ T928] [c0000011a7157e00] [c000000000de21d8] pci_lock_rescan_remove+0x28/0x40 [ 84.964439] [ T928] [c0000011a7157e20] [c00000000004ed98] eeh_pe_bus_get+0x48/0xc0 [ 84.964442] [ T928] [c0000011a7157e50] [c00000 ---truncated---

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Low
IBM POWER hardware-specific Linux subsystem, niche enterprise server segment
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-66393 HIGH POC
8.7
CVE-2026-18140 HIGH POC
8.7
CVE-2026-93687 HIGH POC
8.7
CVE-2026-9769 HIGH POC
8.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45904 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/366062 REF https://git.kernel.org/stable/c/6e6561231c6cfc32c5631aeecc0928ff2b14265c REF https://git.kernel.org/stable/c/788dd28fd49610d6047cbb15dbf1186afffdfbaf REF https://git.kernel.org/stable/c/815a8d2feb5615ae7f0b5befd206af0b0160614c REF https://git.kernel.org/stable/c/87a1f93986aa1500b85aeff16b0b71c29ea116ea REF https://git.kernel.org/stable/c/89810e2d80281d42f855fac813786758ee16e323 REF https://git.kernel.org/stable/c/b85ee287bfe52c6b2d9b41758b5e0d08679d5b39 REF https://git.kernel.org/stable/c/f49faa4a64f8ac0e38983e606075b25dfcfc9ad4 REF https://git.kernel.org/stable/c/f8b16d5764ee1e78c1ef333017ad383ffe76fcdc

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy