CVE-2026-43147

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43147", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.989Z", "datePublished": "2026-05-06T11:27:30.235Z", "dateUpdated": "2026-11-06T15:32:33.682Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:06:24.518Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"\n\nThis reverts commit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\"), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n $ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs\n $ echo 1 > /sys/bus/pci/devices/<pf>/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n zsh/5715 is trying to acquire lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n but task is already holding lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n ...\n Call Trace:\n [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110\n [<00000259779c844e>] print_deadlock_bug+0x31e/0x330\n [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0\n [<00000259779bffac>] lock_acquire+0x14c/0x350\n [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520\n [<000002597896413c>] mutex_lock_nested+0x3c/0x50\n [<00000259784a07e4>] sriov_disable+0x34/0x140\n [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]\n [<00000259784857fc>] pci_device_remove+0x3c/0xa0\n [<000002597851012e>] device_release_driver_internal+0x18e/0x280\n [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0\n [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n [<00000259784972c2>] remove_store+0x72/0x90\n [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200\n [<0000025977d7241c>] vfs_write+0x24c/0x300\n [<0000025977d72696>] ksys_write+0x86/0x110\n [<000002597895b61c>] __do_syscall+0x14c/0x400\n [<000002597896e0ee>] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/iov.c"], "versions": [{"version": "1e8a80290f964bdbad225221c8a1594c7e01c8fd", "lessThan": "f61cdd7e9b67bb8961b0a81bf294b78343e5db05", "status": "affected", "versionType": "git"}, {"version": "a645ca21de09e3137cbb224fa6c23cca873a1d01", "lessThan": "0de341b2365bad430aade0853fe09c2cbe468f59", "status": "affected", "versionType": "git"}, {"version": "a24219172456f035d886857e265ca24c85b167c8", "lessThan": "83651d37474c762920e345a3a0828f975ca4d732", "status": "affected", "versionType": "git"}, {"version": "36039348bca77828bf06eae41b8f76e38cd15847", "lessThan": "639265296fe6ee21b6f00e00ee2bab65f3b07252", "status": "affected", "versionType": "git"}, {"version": "53154cd40ccf285f1d1c24367824082061d155bd", "lessThan": "d47f27e145f8bd13f3c230da5e3af29225b4a2f7", "status": "affected", "versionType": "git"}, {"version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "lessThan": "40f67686a5002c0c322fac918406bbc8d9c2ec2f", "status": "affected", "versionType": "git"}, {"version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "lessThan": "58677783c89681871077f50a7042b0c6380c4fd8", "status": "affected", "versionType": "git"}, {"version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "lessThan": "2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a", "status": "affected", "versionType": "git"}, {"version": "5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf", "status": "affected", "versionType": "git"}, {"version": "ee40e5db052d7c6f406fdb95ad639c894c74674c", "status": "affected", "versionType": "git"}, {"version": "5.10.246", "lessThan": "5.10.252", "status": "affected", "versionType": "semver"}, {"version": "5.15.195", "lessThan": "5.15.202", "status": "affected", "versionType": "semver"}, {"version": "6.1.157", "lessThan": "6.1.165", "status": "affected", "versionType": "semver"}, {"version": "6.6.113", "lessThan": "6.6.128", "status": "affected", "versionType": "semver"}, {"version": "6.12.54", "lessThan": "6.12.75", "status": "affected", "versionType": "semver"}, {"version": "5.4.301", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "6.17.4", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pci/iov.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.252", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.246", "versionEndExcluding": "5.10.252"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.195", "versionEndExcluding": "5.15.202"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.157", "versionEndExcluding": "6.1.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.113", "versionEndExcluding": "6.6.128"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.54", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f61cdd7e9b67bb8961b0a81bf294b78343e5db05"}, {"url": "https://git.kernel.org/stable/c/0de341b2365bad430aade0853fe09c2cbe468f59"}, {"url": "https://git.kernel.org/stable/c/83651d37474c762920e345a3a0828f975ca4d732"}, {"url": "https://git.kernel.org/stable/c/639265296fe6ee21b6f00e00ee2bab65f3b07252"}, {"url": "https://git.kernel.org/stable/c/d47f27e145f8bd13f3c230da5e3af29225b4a2f7"}, {"url": "https://git.kernel.org/stable/c/40f67686a5002c0c322fac918406bbc8d9c2ec2f"}, {"url": "https://git.kernel.org/stable/c/58677783c89681871077f50a7042b0c6380c4fd8"}, {"url": "https://git.kernel.org/stable/c/2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a"}], "title": "Revert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:29:37.623465Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:32:33.682Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:29:37.623465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:29:38.601Z"}}], "cna": {"title": "Revert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1e8a80290f964bdbad225221c8a1594c7e01c8fd", "lessThan": "f61cdd7e9b67bb8961b0a81bf294b78343e5db05", "versionType": "git"}, {"status": "affected", "version": "a645ca21de09e3137cbb224fa6c23cca873a1d01", "lessThan": "0de341b2365bad430aade0853fe09c2cbe468f59", "versionType": "git"}, {"status": "affected", "version": "a24219172456f035d886857e265ca24c85b167c8", "lessThan": "83651d37474c762920e345a3a0828f975ca4d732", "versionType": "git"}, {"status": "affected", "version": "36039348bca77828bf06eae41b8f76e38cd15847", "lessThan": "639265296fe6ee21b6f00e00ee2bab65f3b07252", "versionType": "git"}, {"status": "affected", "version": "53154cd40ccf285f1d1c24367824082061d155bd", "lessThan": "d47f27e145f8bd13f3c230da5e3af29225b4a2f7", "versionType": "git"}, {"status": "affected", "version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "lessThan": "40f67686a5002c0c322fac918406bbc8d9c2ec2f", "versionType": "git"}, {"status": "affected", "version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "lessThan": "58677783c89681871077f50a7042b0c6380c4fd8", "versionType": "git"}, {"status": "affected", "version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "lessThan": "2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a", "versionType": "git"}, {"status": "affected", "version": "5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf", "versionType": "git"}, {"status": "affected", "version": "ee40e5db052d7c6f406fdb95ad639c894c74674c", "versionType": "git"}, {"status": "affected", "version": "5.10.246", "lessThan": "5.10.252", "versionType": "semver"}, {"status": "affected", "version": "5.15.195", "lessThan": "5.15.202", "versionType": "semver"}, {"status": "affected", "version": "6.1.157", "lessThan": "6.1.165", "versionType": "semver"}, {"status": "affected", "version": "6.6.113", "lessThan": "6.6.128", "versionType": "semver"}, {"status": "affected", "version": "6.12.54", "lessThan": "6.12.75", "versionType": "semver"}, {"status": "affected", "version": "5.4.301", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "6.17.4", "lessThan": "6.18", "versionType": "semver"}], "programFiles": ["drivers/pci/iov.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.252", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.202", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.165", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.128", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/pci/iov.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f61cdd7e9b67bb8961b0a81bf294b78343e5db05"}, {"url": "https://git.kernel.org/stable/c/0de341b2365bad430aade0853fe09c2cbe468f59"}, {"url": "https://git.kernel.org/stable/c/83651d37474c762920e345a3a0828f975ca4d732"}, {"url": "https://git.kernel.org/stable/c/639265296fe6ee21b6f00e00ee2bab65f3b07252"}, {"url": "https://git.kernel.org/stable/c/d47f27e145f8bd13f3c230da5e3af29225b4a2f7"}, {"url": "https://git.kernel.org/stable/c/40f67686a5002c0c322fac918406bbc8d9c2ec2f"}, {"url": "https://git.kernel.org/stable/c/58677783c89681871077f50a7042b0c6380c4fd8"}, {"url": "https://git.kernel.org/stable/c/2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"\n\nThis reverts commit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\"), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n $ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs\n $ echo 1 > /sys/bus/pci/devices/<pf>/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n zsh/5715 is trying to acquire lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n but task is already holding lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n ...\n Call Trace:\n [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110\n [<00000259779c844e>] print_deadlock_bug+0x31e/0x330\n [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0\n [<00000259779bffac>] lock_acquire+0x14c/0x350\n [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520\n [<000002597896413c>] mutex_lock_nested+0x3c/0x50\n [<00000259784a07e4>] sriov_disable+0x34/0x140\n [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]\n [<00000259784857fc>] pci_device_remove+0x3c/0xa0\n [<000002597851012e>] device_release_driver_internal+0x18e/0x280\n [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0\n [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n [<00000259784972c2>] remove_store+0x72/0x90\n [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200\n [<0000025977d7241c>] vfs_write+0x24c/0x300\n [<0000025977d72696>] ksys_write+0x86/0x110\n [<000002597895b61c>] __do_syscall+0x14c/0x400\n [<000002597896e0ee>] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.252", "versionStartIncluding": "5.10.246"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.202", "versionStartIncluding": "5.15.195"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.165", "versionStartIncluding": "6.1.157"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.6.113"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.12.54"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.301"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.17.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:06:24.518Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43147", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:32:33.682Z", "dateReserved": "2026-05-01T14:12:55.989Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T11:27:30.235Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/pci/iov.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f61cdd7e9b67bb8961b0a81bf294b78343e5db05", "status": "affected", "version": "1e8a80290f964bdbad225221c8a1594c7e01c8fd", "versionType": "git"}, {"lessThan": "0de341b2365bad430aade0853fe09c2cbe468f59", "status": "affected", "version": "a645ca21de09e3137cbb224fa6c23cca873a1d01", "versionType": "git"}, {"lessThan": "83651d37474c762920e345a3a0828f975ca4d732", "status": "affected", "version": "a24219172456f035d886857e265ca24c85b167c8", "versionType": "git"}, {"lessThan": "639265296fe6ee21b6f00e00ee2bab65f3b07252", "status": "affected", "version": "36039348bca77828bf06eae41b8f76e38cd15847", "versionType": "git"}, {"lessThan": "d47f27e145f8bd13f3c230da5e3af29225b4a2f7", "status": "affected", "version": "53154cd40ccf285f1d1c24367824082061d155bd", "versionType": "git"}, {"lessThan": "40f67686a5002c0c322fac918406bbc8d9c2ec2f", "status": "affected", "version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "versionType": "git"}, {"lessThan": "58677783c89681871077f50a7042b0c6380c4fd8", "status": "affected", "version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "versionType": "git"}, {"lessThan": "2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a", "status": "affected", "version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520", "versionType": "git"}, {"status": "affected", "version": "5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf", "versionType": "git"}, {"status": "affected", "version": "ee40e5db052d7c6f406fdb95ad639c894c74674c", "versionType": "git"}, {"lessThan": "5.10.252", "status": "affected", "version": "5.10.246", "versionType": "semver"}, {"lessThan": "5.15.202", "status": "affected", "version": "5.15.195", "versionType": "semver"}, {"lessThan": "6.1.165", "status": "affected", "version": "6.1.157", "versionType": "semver"}, {"lessThan": "6.6.128", "status": "affected", "version": "6.6.113", "versionType": "semver"}, {"lessThan": "6.12.75", "status": "affected", "version": "6.12.54", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.301", "versionType": "semver"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/pci/iov.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.252", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.202", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.165", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.128", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABCD8233-CFD6-4194-AA34-BD9E287307E3", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.301", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A9DDA2A-4C5B-4449-8771-770D86CF7DDE", "versionEndExcluding": "5.10.252", "versionStartIncluding": "5.10.246", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B24EB1FA-19B2-49D7-A69B-15888BE06274", "versionEndExcluding": "5.15.202", "versionStartIncluding": "5.15.195", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1C6F3EA-9480-4F54-AA05-D52B53EC80F6", "versionEndExcluding": "6.1.165", "versionStartIncluding": "6.1.157", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5E8E922-3FF0-431A-8702-035D4539BF13", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.6.113", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC78A661-1343-4AFE-A84D-E36586DC36A9", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.12.54", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "91D00E25-4134-4FD2-A41C-44EA3CF9D3EE", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.17.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"\n\nThis reverts commit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\"), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n $ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs\n $ echo 1 > /sys/bus/pci/devices/<pf>/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n zsh/5715 is trying to acquire lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n but task is already holding lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n ...\n Call Trace:\n [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110\n [<00000259779c844e>] print_deadlock_bug+0x31e/0x330\n [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0\n [<00000259779bffac>] lock_acquire+0x14c/0x350\n [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520\n [<000002597896413c>] mutex_lock_nested+0x3c/0x50\n [<00000259784a07e4>] sriov_disable+0x34/0x140\n [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]\n [<00000259784857fc>] pci_device_remove+0x3c/0xa0\n [<000002597851012e>] device_release_driver_internal+0x18e/0x280\n [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0\n [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n [<00000259784972c2>] remove_store+0x72/0x90\n [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200\n [<0000025977d7241c>] vfs_write+0x24c/0x300\n [<0000025977d72696>] ksys_write+0x86/0x110\n [<000002597895b61c>] __do_syscall+0x14c/0x400\n [<000002597896e0ee>] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: Revertir \u2019PCI/IOV: A\u00f1adir bloqueo de reescaneo-eliminaci\u00f3n de PCI al habilitar/deshabilitar SR-IOV\u2019 Esto revierte el commit 05703271c3cd (\u2019PCI/IOV: A\u00f1adir bloqueo de reescaneo-eliminaci\u00f3n de PCI al habilitar/deshabilitar SR-IOV\u2019), lo que causa un interbloqueo al tomar recursivamente pci_rescan_remove_lock cuando se llama a sriov_del_vfs() como parte de pci_stop_and_remove_bus_device(). Por ejemplo, con la siguiente secuencia de comandos: $ echo [NUM] > /sys/bus/pci/devices/[pf]/sriov_numvfs $ echo 1 > /sys/bus/pci/devices/[pf]/remove Una traza recortada del interbloqueo en un dispositivo mlx5 es la siguiente: zsh/5715 est\u00e1 intentando adquirir el bloqueo: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140 pero la tarea ya est\u00e1 manteniendo el bloqueo: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80 ... Traza de Llamada: [menor que 00000259778c4f90>] dump_stack_lvl+0xc0/0x110 [menor que 00000259779c844e>] print_deadlock_bug+0x31e/0x330 [menor que 00000259779c1908>] __lock_acquire+0x 16c8/0x 32f0 [menor que 00000259779bffac>] lock_acquire+0x14c/0x350 [menor que 00000259789643a6>] __mutex_lock_common+0xe6/0x 1520 [menor que 000002597896413c>] mutex_lock_nested+0x3c/0x50 [menor que 00000259784a07e4>] sriov_disable+0x34/0x140 [menor que 00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core] [menor que 00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core] [menor que 00000259784857fc>] pci_device_remove+0x3c/0xa0 [menor que 000002597851012e>] device_release_driver_internal+0x18e/0x280 [menor que 000002597847ae22>] pci_stop_bus_device+0x82/0xa0 [menor que 000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80 [menor que 00000259784972c2>] remove_store+0x72/0x90 [menor que 0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200 [menor que 0000025977d7241c>] vfs_write+0x24c/0x300 [menor que 0000025977d72696>] ksys_write+0x86/0x110 [menor que 000002597895b61c>] __do_syscall+0x14c/0x400 [menor que 000002597896e0ee>] system_call+0x6e/0x90 Esto por s\u00ed solo no es una soluci\u00f3n completa ya que restaura el problema que el commit citado intent\u00f3 resolver. Una nueva soluci\u00f3n ser\u00e1 proporcionada como seguimiento."}], "id": "CVE-2026-43147", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43147", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:29:37.623465Z", "version": "2.0.3"}}]}, "published": "2026-05-06T12:16:32.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0de341b2365bad430aade0853fe09c2cbe468f59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/40f67686a5002c0c322fac918406bbc8d9c2ec2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/58677783c89681871077f50a7042b0c6380c4fd8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/639265296fe6ee21b6f00e00ee2bab65f3b07252"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83651d37474c762920e345a3a0828f975ca4d732"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d47f27e145f8bd13f3c230da5e3af29225b4a2f7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f61cdd7e9b67bb8961b0a81bf294b78343e5db05"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Revert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"", "id": "2467231", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467231"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel. A local user can cause a system deadlock by performing specific operations related to SR-IOV (Single Root I/O Virtualization) device removal. This occurs due to a recursive lock acquisition within the PCI (Peripheral Component Interconnect) subsystem, specifically when sriov_del_vfs() is called during device removal. The consequence is system unresponsiveness, leading to a Denial of Service (DoS)."], "name": "CVE-2026-43147", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43147\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43147\nhttps://lore.kernel.org/linux-cve-announce/2026050627-CVE-2026-43147-4a3c@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1e8a80290f964bdbad225221c8a1594c7e01c8fd,f61cdd7e9b67bb8961b0a81bf294b78343e5db05)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a645ca21de09e3137cbb224fa6c23cca873a1d01,0de341b2365bad430aade0853fe09c2cbe468f59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a24219172456f035d886857e265ca24c85b167c8,83651d37474c762920e345a3a0828f975ca4d732)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[36039348bca77828bf06eae41b8f76e38cd15847,639265296fe6ee21b6f00e00ee2bab65f3b07252)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[53154cd40ccf285f1d1c24367824082061d155bd,d47f27e145f8bd13f3c230da5e3af29225b4a2f7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[05703271c3cdcc0f2a8cf6ebdc45892b8ca83520,40f67686a5002c0c322fac918406bbc8d9c2ec2f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[05703271c3cdcc0f2a8cf6ebdc45892b8ca83520,58677783c89681871077f50a7042b0c6380c4fd8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[05703271c3cdcc0f2a8cf6ebdc45892b8ca83520,2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ee40e5db052d7c6f406fdb95ad639c894c74674c"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.252,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.202,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.165,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.128,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.75,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.16,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.6,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T14:00:06.620662+00:00", "updated": "2026-05-13T22:15:09.830846+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}