{"id":"CVE-2026-43115","state":"PUBLISHED","title":"srcu: Use irq_work to start GP in tiny SRCU","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Use irq_work to start GP in tiny SRCU\n\nTiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),\nwhich acquires the workqueue pool->lock.\n\nThis causes a lockdep splat when call_srcu() is called with a scheduler\nlock held, due to:\n\n  call_srcu() [holding pi_lock]\n    srcu_gp_start_if_needed()\n      schedule_work() -> pool->lock\n\n  workqueue_init() / create_worker() [holding pool->lock]\n    wake_up_process() -> try_to_wake_up() -> pi_lock\n\nAlso add irq_work_sync() to cleanup_srcu_struct() to prevent a\nuse-after-free if a queued irq_work fires after cleanup begins.\n\nTested with rcutorture SRCU-T and no lockdep warnings.\n\n[ Thanks to Boqun for similar fix in patch \"rcu: Use an intermediate irq_work\nto start process_srcu()\" ]","publishedAt":"2026-05-06T07:40:40.541Z","updatedAt":"2026-10-30T12:24:58.376Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d8be81735aa89413b333de488251f0e64e2be591","status":"affected","lessThan":"28768bc7ea0b13f558a70f63cc3cfcd32d55d488","versionType":"git"},{"version":"d8be81735aa89413b333de488251f0e64e2be591","status":"affected","lessThan":"bb37286db65368cb72ba8757ad86299c4e4a73fc","versionType":"git"},{"version":"d8be81735aa89413b333de488251f0e64e2be591","status":"affected","lessThan":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.12","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.14","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"]}],"references":["https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488","https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc","https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"],"weaknesses":[],"ingestedAt":"2026-10-30T12:42:04.495Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43115.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43115","state":"PUBLISHED","datePublished":"2026-05-06T07:40:40.541Z","dateUpdated":"2026-10-30T12:24:58.376Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:55.986Z"},"containers":{"cna":{"title":"srcu: Use irq_work to start GP in tiny SRCU","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Use irq_work to start GP in tiny SRCU\n\nTiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),\nwhich acquires the workqueue pool->lock.\n\nThis causes a lockdep splat when call_srcu() is called with a scheduler\nlock held, due to:\n\n  call_srcu() [holding pi_lock]\n    srcu_gp_start_if_needed()\n      schedule_work() -> pool->lock\n\n  workqueue_init() / create_worker() [holding pool->lock]\n    wake_up_process() -> try_to_wake_up() -> pi_lock\n\nAlso add irq_work_sync() to cleanup_srcu_struct() to prevent a\nuse-after-free if a queued irq_work fires after cleanup begins.\n\nTested with rcutorture SRCU-T and no lockdep warnings.\n\n[ Thanks to Boqun for similar fix in patch \"rcu: Use an intermediate irq_work\nto start process_srcu()\" ]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d8be81735aa89413b333de488251f0e64e2be591","status":"affected","lessThan":"28768bc7ea0b13f558a70f63cc3cfcd32d55d488","versionType":"git"},{"version":"d8be81735aa89413b333de488251f0e64e2be591","status":"affected","lessThan":"bb37286db65368cb72ba8757ad86299c4e4a73fc","versionType":"git"},{"version":"d8be81735aa89413b333de488251f0e64e2be591","status":"affected","lessThan":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.12","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.14","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488"},{"url":"https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc"},{"url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:24:58.376Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.19.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}