Linux kernel (drivers/pci): A Downstream Port Containment event and a device removal happening at the same time leave

Impact

A Downstream Port Containment event and a device removal happening at the same time leave the DPC handler polling the config space of a struct pci_dev that has already been freed. That is a use-after-free in an interrupt thread on the host - it panics the node, and a freed-and-reallocated pci_dev is the kind of primitive that turns a device-triggered error into host memory corruption rather than just a crash.

Who can reach it

The DPC half is device-driven, not admin-driven: an endpoint that emits an uncorrectable error - a wedged or deliberately misbehaving NVMe drive, a passthrough GPU or NIC a tenant is hammering with malformed transactions - makes the Downstream Port fire DPC, and dpc_handler() then walks the child device without holding a reference. If a hot-removal (pciehp, surprise removal of an NVMe, or an admin-triggered remove) races that window, the handler dereferences freed memory. Reachable on any node with DPC-capable root/downstream ports and hot-pluggable devices; needs no tenant credentials on the host, only a device that can be pushed into generating errors.

What to do

Update to 5.10.224 / 5.15.165 / 6.1.103 / 6.3 or later. Interim: avoid concurrent hot-remove operations on ports that have DPC enabled, and drain a node before servicing or removing PCIe devices rather than surprise-pulling them under load.

References

Related entries

• Linux kernel (drivers/pci): A pci_slot holds an uncounted pointer to the pci_bus below it, and on hot removal the busCVE-2024-53194 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): The PCI bus match callback read driver_override without the device lock, so the overrideCVE-2026-53120 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): Pm_runtime_get_sync() does not wait for an already-running .runtime_idle() callback, so aCVE-2024-35809 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): Tearing down a PF that still has SR-IOV VFs takes pci_rescan_remove_lock recursively andCVE-2026-43147 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): Pci_dev_lock() and the sysfs SR-IOV path took the device lock and the config-space accessCVE-2022-49434 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci): The DOE state machine signals the caller's completion before destroying the work_structCVE-2023-54235 · Linux kernel (drivers/pci)Medium