In the Linux kernel, the following vulnerability has been resolved:
Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"), which causes a deadlock by recursively taking pcirescanremovelock when sriovdelvfs() is called as part of pcistopandremovebusdevice(). For example with the following sequence of commands:
$ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs $ echo 1 > /sys/bus/pci/devices/<pf>/remove
A trimmed trace of the deadlock on a mlx5 device is as below:
zsh/5715 is trying to acquire lock: 000002597926ef50 (pcirescanremovelock){+.+.}-{3:3}, at: sriovdisable+0x34/0x140
but task is already holding lock: 000002597926ef50 (pcirescanremovelock){+.+.}-{3:3}, at: pcistopandremovebusdevicelocked+0x24/0x80 ... Call Trace: [<00000259778c4f90>] dumpstacklvl+0xc0/0x110 [<00000259779c844e>] printdeadlock_bug+0x31e/0x330 [<00000259779c1908>] __lockacquire+0x16c8/0x32f0 [<00000259779bffac>] lockacquire+0x14c/0x350 [<00000259789643a6>] __mutexlockcommon+0xe6/0x1520 [<000002597896413c>] mutexlocknested+0x3c/0x50 [<00000259784a07e4>] sriovdisable+0x34/0x140 [<00000258f7d6dd80>] mlx5sriovdisable+0x50/0x80 [mlx5core] [<00000258f7d5745e>] removeone+0x5e/0xf0 [mlx5core] [<00000259784857fc>] pcideviceremove+0x3c/0xa0 [<000002597851012e>] devicereleasedriverinternal+0x18e/0x280 [<000002597847ae22>] pcistopbusdevice+0x82/0xa0 [<000002597847afce>] pcistopandremovebusdevicelocked+0x5e/0x80 [<00000259784972c2>] removestore+0x72/0x90 [<0000025977e6661a>] kernfsfopwriteiter+0x15a/0x200 [<0000025977d7241c>] vfswrite+0x24c/0x300 [<0000025977d72696>] ksyswrite+0x86/0x110 [<000002597895b61c>] __dosyscall+0x14c/0x400 [<000002597896e0ee>] systemcall+0x6e/0x90
This alone is not a complete fix as it restores the issue the cited commit tried to solve. A new fix will be provided as a follow on.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43147.json",
"cna_assigner": "Linux"
}