CVE-2024-26605

A flaw was found in the Linux kernel, where a deadlock scenario was triggered when enabling Active State Power Management (ASPM) during the probe of Qualcomm PCIe controllers. This deadlock was identified by lockdep and stemmed from a recursive locking scenario. This issue occurred when a task attempted to acquire a lock already held by another task, leading to a deadlock situation. The deadlock could be reproduced on certain machines, such as the Lenovo ThinkPad X13s, by intentionally delaying operations to increase the race window during asynchronous probes, allowing another thread to take a write lock.

The identified vulnerability, while significant in terms of potential system instability, is categorized as Low severity due to several factors. First, the deadlock scenario is triggered under specific conditions during the probe of Qualcomm PCIe controllers, limiting its impact to a subset of hardware configurations. Additionally, the deadlock can be reliably reproduced only with deliberate manipulation, such as introducing delays to increase the race window during asynchronous probe operations. Furthermore, the issue does not pose a direct security threat or enable unauthorized access or privilege escalation. Last, the timely identification and resolution of the problem by introducing a targeted fix demonstrate the robustness of the Linux kernel development process in addressing such issues efficiently.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.