Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-93098

rpmsg: glink: fix deadlock in endpoint destroy during driver detach

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely. The deadlock manifests with the following call chain: [<0>] device_del+0x44/0x414  <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered: - Driver detach path: the driver core already tears down the rpmsg device. - Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached. Remove the redundant unregistration to fix the deadlock.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 93b6b9e4acff4794e7426d3ad64ef14e3b3e8919 to < 73092c2292aa65515671e54abbcda2166d3827edaffected
  • 24fd02c3a4798de7dc94b55d36a1685fe6cdaf69 to < bbc236357876d35a624030e5c50eedbc380be98eaffected
  • 32fe8cdf541863239b81c80b8b04112d6e8792cf to < 8597f669a5268e0dcf243e2b2d6ca00370117057affected
  • c6210714347f72bae8e7142dc0a7f99923c466e7 to < 48f55b90f0d713e477e26b85d7327d9592d016f9affected
  • fcab5c2672f8dac3d77013dbe047b2441f4141f5 to < cbcdf96e1c87bc07055d04264018ded1f3bafffbaffected
  • f80e4e91b010ee7d6c52f24d069975ac955ac6b2 to < ecad679e2b92c419cc22cc8f257cd457d5192647affected
  • a53e356df548f6b0e82529ef3cc6070f42622189 to < e559626bee8a6632aafc08eedcdb4bf26ca245c5affected
  • a53e356df548f6b0e82529ef3cc6070f42622189 to < 5a5a48e788e02fd8a8eb7188ce440572d6c12418affected
  • 5.10.248 to < 5.10.270affected
  • 5.15.198 to < 5.15.221affected
  • 6.1.160 to < 6.1.188affected
  • 6.6.120 to < 6.6.157affected
  • 6.12.64 to < 6.12.110affected
  • 6.18.3 to < 6.18.52affected

Linux Linux

Default version status: affected

  • 6.19affected
  • 0 to < 6.19unaffected
  • 5.10.270 to ≤ 5.10.*unaffected
  • 5.15.221 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References