PCI: Fix pci_slot_trylock() error handling

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-43211
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-06 12:16:40 UTC
Updated2026-05-11 19:58:10 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/[email protected]]

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.000120000 probability, percentile 0.017700000 (date 2026-05-11)

Problem Types: CWE-667

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected e2355d513b89a2cb511b4ded0deb426cdb01acd0 ebb27b7399ab8b9eb1f792b329aa5f6250c590d4 git Not specified
CNA Linux Linux affected 04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945 fbe06a3058114bf95a17a4941b205f4b321c6f0a git Not specified
CNA Linux Linux affected 7253b4fed46471cc247c6cacefac890a8472c083 943ed56606a7ab2fe5a99cad572dd17d484310c7 git Not specified
CNA Linux Linux affected 78c6e39fef5c428960aff742149bba302dd46f5a a19b61fdb958ffadbba85b43c991eb9fc70c1c1c git Not specified
CNA Linux Linux affected a4e772898f8bf2e7e1cf661a12c60a5612c4afab 0425aaf20b407d2f2cf3bf469808e4a35f9abb8b git Not specified
CNA Linux Linux affected a4e772898f8bf2e7e1cf661a12c60a5612c4afab bd435f4b738130d732ef64e0e57e45185f77165d git Not specified
CNA Linux Linux affected a4e772898f8bf2e7e1cf661a12c60a5612c4afab 8b08ea9690b212b7bf7f12414039259cf34b1aa0 git Not specified
CNA Linux Linux affected a4e772898f8bf2e7e1cf661a12c60a5612c4afab 9368d1ee62829b08aa31836b3ca003803caf0b72 git Not specified
CNA Linux Linux affected 0790b89c7e911003b8c50ae50e3ac7645de1fae9 git Not specified
CNA Linux Linux affected df77a678c33871a6e4ac5b54a71662f1d702335b git Not specified
CNA Linux Linux affected 81c68e218ab883dfa368460a59b674084c0240da git Not specified
CNA Linux Linux affected 6.11 Not specified
CNA Linux Linux unaffected 6.11 semver Not specified
CNA Linux Linux unaffected 5.10.252 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.202 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.165 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.128 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.75 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.16 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.6 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/a19b61fdb958ffadbba85b43c991eb9fc70c1c1c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/9368d1ee62829b08aa31836b3ca003803caf0b72 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/0425aaf20b407d2f2cf3bf469808e4a35f9abb8b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/bd435f4b738130d732ef64e0e57e45185f77165d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/8b08ea9690b212b7bf7f12414039259cf34b1aa0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/fbe06a3058114bf95a17a4941b205f4b321c6f0a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/ebb27b7399ab8b9eb1f792b329aa5f6250c590d4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/943ed56606a7ab2fe5a99cad572dd17d484310c7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report