From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 89B0C50B8D6 for ; Thu, 17 Sep 2026 16:36:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789663012; cv=none; b=ov5Db1s1c2oTE+9mP9rRpdVu9bsZNHbpMZIajF5U54xLdJ2vrjTFR8nRqsRilgd0gjBSHAxp6wB1orRA4ud4vJsWE6ETY8zGN2d0yq89fyqE660QX7fLKJ0arDQRG/rZKGM1JCmpGlKOpikaQBq9HZ+nun/lxR78+nzOlSPncm0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789663012; c=relaxed/simple; bh=ZDpBBJJQgWyFbOyTFMiIuTzS6Wb4XSY+/1usW0aqw6s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=T2Q4tSZC46k12Nw3dkkxX8fDEVVuD7AL2fDFnQNfZcGEXl/xI4qC8ZlQsui7uM/PpRzJOBtxWXE/FZ4c5SwRuI2TvpTujLXUGIneruYYPAKbPD/rC/lS0yizm/MuRiYwuznhCFGXtdMucHbmbOnhc9izLd9+8ezy+tJUYDdJeqQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rjRfRxSR; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="rjRfRxSR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E26461F00898; Thu, 17 Sep 2026 16:36:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789663011; bh=gCQZgnbjHEDdNf9dVf76OWRDehwTEj+SzZfq4sDORpU=; h=From:To:Cc:Subject:Date:Reply-To; b=rjRfRxSRC+ALHqKZTDe9/UZchPLCjC5LhXqW+jh6/wuuMOPFZs+bQgFb74HMRSHpV 4+QkYaDDrfu4gaCf/sMx9tsPNK7td4gN2SXzjCYd0YC3+jcPsQPqmenvfpXLeaoYhu coDGNt2x10plvuZrqck0atYApZmvlb4X3u+8TKUk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-93098: rpmsg: glink: fix deadlock in endpoint destroy during driver detach Date: Thu, 17 Sep 2026 17:16:15 +0100 Message-ID: <2026091744-CVE-2026-93098-7ef4@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4850; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=lCxpYiEOL/OwMyXpYV5rnRZ5/1TsJsvoL8yrl9I8sAY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBE5UMP5aWjH7AGdegf56o715l4VFylQ1X63jrn/qb 3hbLHJbRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzk2hqG+SGRXU0pGrk72/l2 bTJ7sW7+UkGuYwwLjge9qBPRZ554LuD43f3fk/a8lDvwFAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely. The deadlock manifests with the following call chain: [<0>] device_del+0x44/0x414  <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered: - Driver detach path: the driver core already tears down the rpmsg device. - Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached. Remove the redundant unregistration to fix the deadlock. The Linux kernel CVE team has assigned CVE-2026-93098 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10.248 with commit 93b6b9e4acff4794e7426d3ad64ef14e3b3e8919 and fixed in 5.10.270 with commit 73092c2292aa65515671e54abbcda2166d3827ed Issue introduced in 5.15.198 with commit 24fd02c3a4798de7dc94b55d36a1685fe6cdaf69 and fixed in 5.15.221 with commit bbc236357876d35a624030e5c50eedbc380be98e Issue introduced in 6.1.160 with commit 32fe8cdf541863239b81c80b8b04112d6e8792cf and fixed in 6.1.188 with commit 8597f669a5268e0dcf243e2b2d6ca00370117057 Issue introduced in 6.6.120 with commit c6210714347f72bae8e7142dc0a7f99923c466e7 and fixed in 6.6.157 with commit 48f55b90f0d713e477e26b85d7327d9592d016f9 Issue introduced in 6.12.64 with commit fcab5c2672f8dac3d77013dbe047b2441f4141f5 and fixed in 6.12.110 with commit cbcdf96e1c87bc07055d04264018ded1f3bafffb Issue introduced in 6.18.3 with commit f80e4e91b010ee7d6c52f24d069975ac955ac6b2 and fixed in 6.18.52 with commit ecad679e2b92c419cc22cc8f257cd457d5192647 Issue introduced in 6.19 with commit a53e356df548f6b0e82529ef3cc6070f42622189 and fixed in 7.2.6 with commit e559626bee8a6632aafc08eedcdb4bf26ca245c5 Issue introduced in 6.19 with commit a53e356df548f6b0e82529ef3cc6070f42622189 and fixed in 7.3-rc1 with commit 5a5a48e788e02fd8a8eb7188ce440572d6c12418 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-93098 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/rpmsg/qcom_glink_native.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/73092c2292aa65515671e54abbcda2166d3827ed https://git.kernel.org/stable/c/bbc236357876d35a624030e5c50eedbc380be98e https://git.kernel.org/stable/c/8597f669a5268e0dcf243e2b2d6ca00370117057 https://git.kernel.org/stable/c/48f55b90f0d713e477e26b85d7327d9592d016f9 https://git.kernel.org/stable/c/cbcdf96e1c87bc07055d04264018ded1f3bafffb https://git.kernel.org/stable/c/ecad679e2b92c419cc22cc8f257cd457d5192647 https://git.kernel.org/stable/c/e559626bee8a6632aafc08eedcdb4bf26ca245c5 https://git.kernel.org/stable/c/5a5a48e788e02fd8a8eb7188ce440572d6c12418