KernelScan.io

HIGH

pci SlotTrylock Unlock

CVE-2026-43211

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI3.9LOW

01

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com]

02

Engine v0.2.0

Risk summary

Systems with PCI devices are at risk of kernel warnings, potential deadlocks, or system instability when PCI slot operations are performed under lock contention. The bug can cause incorrect unlock operations that may lead to lock state corruption and system reliability issues.

Affecteddrivers/pci/pci.c (PCI subsystem)

Vulnerability analysis

The vulnerability stems from incomplete refactoring in commit a4e772898f8b which moved bridge device locking from pci_slot_trylock() to pci_bus_trylock() but left behind a pci_dev_unlock() call in the error path. This causes the code to attempt unlocking a lock it never acquired, leading to either kernel warnings about unlocking unheld locks or incorrect unlocking of locks held by other threads. The fix removes the redundant unlock call. Attack surface is local, requiring root privileges to trigger PCI operations through sysfs interfaces or device hotplug events. Exploitation requires a race condition where pci_bus_trylock() fails due to concurrent PCI operations.

03

BranchFixed inPatch commit
4.204.200425aaf20b40
5.105.10.252ebb27b7399ab
5.155.15.202fbe06a305811
5.55.5bd435f4b7381
6.16.1.165943ed56606a7
6.116.118b08ea9690b2
6.126.12.759368d1ee6282
6.186.18.16
6.196.19.6
6.66.6.128a19b61fdb958
mainline7.0