In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix use-after-free of slot->bus on hot remove
Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock.
Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver.
The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock.
The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus.
In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device().
However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device().
In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free.
One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming.
If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change.
Abridged stacktrace:
pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.233-223.887Upgrade kernel-livepatch-5.15.176-118.170Upgrade kernel-develUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade python-perf | Mar 14, 2025 | Dec 27, 2024 |
| Amazon_linux_2023 | — | Upgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.124-134.200Upgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perfUpgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-debuginfo | Mar 27, 2025 | Dec 27, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jan 13, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel | Mar 18, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Apr 11, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade python3-perfUpgrade bpftool | Mar 19, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libs | Apr 1, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Mar 18, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Feb 11, 2025 | Dec 27, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | May 15, 2025 | Dec 27, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-raspiUpgrade linux-image-5.15.0-1084-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.11.0-1009-awsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-intelUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-135-genericUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-6.8.0-58-genericUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-azureUpgrade linux-image-gkeopUpgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-nvidiaUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-genericUpgrade linux-image-fipsUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-oem-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-oem-22.04cUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-1147-azureUpgrade linux-image-oemUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-nvidia-tegraUpgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-aws-fipsUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-gcp-fipsUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-135-fipsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-virtualUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-gke-5.15Upgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-nvidia-64kUpgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-azure-fipsUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1080-awsUpgrade linux-image-ibm-classicUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-raspi-realtimeUpgrade linux-image-oem-osp1Upgrade linux-image-oem-22.04bUpgrade linux-image-azure-lts-20.04Upgrade linux-image-bluefieldUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-awsUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-gkeop-6.8Upgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-6.11.0-18-generic | Feb 20, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub