Linux kernel powerpc/eeh: recursive locking hangs the EEH handler during PCI error recovery

Impact

A refactor moved pci_rescan_remove_lock acquisition up into eeh_handle_normal_event() but left the old lock/unlock inside eeh_rmv_device(), so the EEH handler thread deadlocks on a lock it already holds. The provided stack trace shows eehd stuck in pci_lock_rescan_remove() under eeh_reset_device(). It triggers when an error is detected on the PHB directly, or on a device whose driver returns PCI_ERS_RESULT_NEED_RESET without EEH-aware slot_reset()/resume() handlers. The operator consequence on a POWER accelerator node is that PCIe error recovery never completes: instead of the GPU or adapter being reset and the node continuing, the recovery thread hangs and the node must be rebooted. Only ppc64 systems are affected; this is a reliability and availability bug, not an attacker-triggered one. No CVSS score or CWE is in the record.

Who can reach it

No attacker path in the record. Reached by a hardware or firmware-reported PCIe error on a POWER host - a PHB-level error, or a device whose driver is not EEH sensitive. Local or remote reachability is not established.

What to do

Update to a stable kernel that removes the redundant lock/unlock in eeh_rmv_device() and reboot the POWER nodes. The record provides stable commits only, no fixed version numbers. Nodes on x86 or arm64 need no action.

References

Related entries

• Linux LIO iSCSI target: LUN_RESET on a WRITE_PENDING command deadlocks the target worker threadCVE-2026-97951 · Linux kernel SCSI target iSCSI frontend (aborted WRITE_PENDING dataout handling)Unscored
• Linux kernel vhost-vdpa: failed eventfd install leaves an ERR_PTR reachable by the config callbackCVE-2026-97993 · Linux kernel vhost-vdpa (ERR_PTR installed in v->config_ctx by VHOST_VDPA_SET_CONFIG_CALL)Unscored
• Linux kernel vhost-vdpa: queue size is not checked against the device maximum, giving an out-of-bounds descriptor readCVE-2026-97994 · Linux kernel vhost-vdpa (VHOST_SET_VRING_NUM validation)Unscored
• Linux kernel BPF verifier (bpf_loop nr_loops argument type): bpf_loop() declared nr_loops as ARG_ANYTHING, so aCVE-2026-98007 · Linux kernel BPF verifier (bpf_loop nr_loops argument type)Unscored
• Linux kernel BPF: bpf_btf_find_by_name_kind() can sleep in softirq context and install an fd into the interrupted taskCVE-2026-98046 · Linux kernel BPF helper bpf_btf_find_by_name_kind() (missing sleepable annotation)Unscored
• Linux kernel BPF: bpf_snprintf_btf() on a BTF_KIND_VAR from base BTF NULL-derefs in btf_var_show()CVE-2026-98063 · Linux kernel BPF BTF display (btf_var_show() unguarded resolved_ids deref)Unscored