CVE-2026-93098

rpmsg: glink: fix deadlock in endpoint destroy during driver detach

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: glink: fix deadlock in endpoint destroy during driver detach

During driver detach, the device core holds the device mutex throughout
the driver's remove callback chain. When the rpmsg endpoint is
destroyed as part of that teardown, the GLINK endpoint destroy
implementation attempts to unregister the underlying rpmsg device.
That unregistration calls device_del(), which tries to re-acquire the
same device mutex already held higher up the stack, causing rmmod to
hang indefinitely.

The deadlock manifests with the following call chain:

[<0>] device_del+0x44/0x414 <- tries to acquire same mutex
[<0>] device_unregister+0x18/0x34
[<0>] rpmsg_unregister_device+0x28/0x4c
[<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0
[<0>] qcom_glink_destroy_ept+0x58/0xbc
[<0>] rpmsg_dev_remove+0x50/0x60
[<0>] device_remove+0x4c/0x80
[<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex
[<0>] driver_detach+0x4c/0x98
[<0>] bus_remove_driver+0x6c/0xbc
[<0>] driver_unregister+0x30/0x60
[<0>] unregister_rpmsg_driver+0x10/0x1c
[<0>] fastrpc_exit+0x28/0x38 [fastrpc]
[<0>] __arm64_sys_delete_module+0x1b8/0x294
[<0>] invoke_syscall+0x48/0x10c
[<0>] el0_svc_common.constprop.0+0xc0/0xe0
[<0>] do_el0_svc+0x1c/0x28
[<0>] el0_svc+0x34/0x108
[<0>] el0t_64_sync_handler+0xa0/0xe4
[<0>] el0t_64_sync+0x198/0x19c

The rpmsg device unregistration inside endpoint destroy is redundant.
In both contexts where endpoint destruction is triggered:

- Driver detach path: the driver core already tears down the rpmsg
device.

- Channel close path: the rpmsg device is already unregistered before
endpoint destruction is reached.

Remove the redundant unregistration to fix the deadlock.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`93b6b9e4acff4794e7426d3ad64ef14e3b3e8919`	affected	< 73092c2292aa65515671e54abbcda2166d3827ed
`24fd02c3a4798de7dc94b55d36a1685fe6cdaf69`	affected	< bbc236357876d35a624030e5c50eedbc380be98e
`32fe8cdf541863239b81c80b8b04112d6e8792cf`	affected	< 8597f669a5268e0dcf243e2b2d6ca00370117057
`c6210714347f72bae8e7142dc0a7f99923c466e7`	affected	< 48f55b90f0d713e477e26b85d7327d9592d016f9
`fcab5c2672f8dac3d77013dbe047b2441f4141f5`	affected	< cbcdf96e1c87bc07055d04264018ded1f3bafffb
`f80e4e91b010ee7d6c52f24d069975ac955ac6b2`	affected	< ecad679e2b92c419cc22cc8f257cd457d5192647
`a53e356df548f6b0e82529ef3cc6070f42622189`	affected	< e559626bee8a6632aafc08eedcdb4bf26ca245c5
`a53e356df548f6b0e82529ef3cc6070f42622189`	affected	< 5a5a48e788e02fd8a8eb7188ce440572d6c12418
`5.10.248`	affected	< 5.10.270
`5.15.198`	affected	< 5.15.221
`6.1.160`	affected	< 6.1.188
`6.6.120`	affected	< 6.6.157
`6.12.64`	affected	< 6.12.110
`6.18.3`	affected	< 6.18.52

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[93b6b9e4acff4794e7426d3ad64ef14e3b3e8919,73092c2292aa65515671e54abbcda2166d3827ed)`	affected	code_commit	—
`[24fd02c3a4798de7dc94b55d36a1685fe6cdaf69,bbc236357876d35a624030e5c50eedbc380be98e)`	affected	code_commit	—
`[32fe8cdf541863239b81c80b8b04112d6e8792cf,8597f669a5268e0dcf243e2b2d6ca00370117057)`	affected	code_commit	—
`[c6210714347f72bae8e7142dc0a7f99923c466e7,48f55b90f0d713e477e26b85d7327d9592d016f9)`	affected	code_commit	—
`[fcab5c2672f8dac3d77013dbe047b2441f4141f5,cbcdf96e1c87bc07055d04264018ded1f3bafffb)`	affected	code_commit	—
`[f80e4e91b010ee7d6c52f24d069975ac955ac6b2,ecad679e2b92c419cc22cc8f257cd457d5192647)`	affected	code_commit	—
`[a53e356df548f6b0e82529ef3cc6070f42622189,e559626bee8a6632aafc08eedcdb4bf26ca245c5)`	affected	code_commit	—
`[a53e356df548f6b0e82529ef3cc6070f42622189,5a5a48e788e02fd8a8eb7188ce440572d6c12418)`	affected	code_commit	—
`[5.10.248,5.10.270)`	affected	semver	—
`[5.15.198,5.15.221)`	affected	semver	—
`[6.1.160,6.1.188)`	affected	semver	—
`[6.6.120,6.6.157)`	affected	semver	—
`[6.12.64,6.12.110)`	affected	semver	—
`[6.18.3,6.18.52)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.19`	affected	semver	—
`[0,6.19)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/48f55b90f0d713e477e26b85d7327d9592d016f9
https://git.kernel.org/stable/c/5a5a48e788e02fd8a8eb7188ce440572d6c12418
https://git.kernel.org/stable/c/73092c2292aa65515671e54abbcda2166d3827ed
https://git.kernel.org/stable/c/8597f669a5268e0dcf243e2b2d6ca00370117057
https://git.kernel.org/stable/c/bbc236357876d35a624030e5c50eedbc380be98e
https://git.kernel.org/stable/c/cbcdf96e1c87bc07055d04264018ded1f3bafffb
https://git.kernel.org/stable/c/e559626bee8a6632aafc08eedcdb4bf26ca245c5
https://git.kernel.org/stable/c/ecad679e2b92c419cc22cc8f257cd457d5192647

History

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely. The deadlock manifests with the following call chain: [<0>] device_del+0x44/0x414 <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered: - Driver detach path: the driver core already tears down the rpmsg device. - Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached. Remove the redundant unregistration to fix the deadlock.
Title		rpmsg: glink: fix deadlock in endpoint destroy during driver detach
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/48f55b90f0d713e477e26b85d7327d9592d016f9 https://git.kernel.org/stable/c/5a5a48e788e02fd8a8eb7188ce440572d6c12418 https://git.kernel.org/stable/c/73092c2292aa65515671e54abbcda2166d3827ed https://git.kernel.org/stable/c/8597f669a5268e0dcf243e2b2d6ca00370117057 https://git.kernel.org/stable/c/bbc236357876d35a624030e5c50eedbc380be98e https://git.kernel.org/stable/c/cbcdf96e1c87bc07055d04264018ded1f3bafffb https://git.kernel.org/stable/c/e559626bee8a6632aafc08eedcdb4bf26ca245c5 https://git.kernel.org/stable/c/ecad679e2b92c419cc22cc8f257cd457d5192647