CVE-2026-93818

A flaw was found in the Linux kernel's PLDA PCIe host controller driver. This vulnerability can result in a Denial of Service (DoS) caused by a race condition when removing a root bus without holding the required lock. A local user with administrative privileges can exploit this issue by triggering concurrent device rescan or hotplug operations via sysfs, resulting in a use-after-free condition (accessing memory after it has been deallocated) and a system crash.

A moderate-severity race condition flaw was found in the Linux kernel's PLDA PCIe host controller driver. The driver stops and removes a PCI root bus without holding the pci_rescan_remove_lock, so the removal can race with concurrent PCI rescan or hotplug operations triggered via sysfs. A local attacker with administrative privileges who can trigger such concurrent operations could win the race and cause a use-after-free condition, resulting in a kernel crash and denial of service. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected by this flaw. Because the flaw is rated Moderate and exploiting it requires privileged local access and winning a narrow race window, fixes for the affected streams have been deferred to a future update, leaving a residual risk of local denial of service. Other Red Hat Enterprise Linux versions, including the kernel-rt variant, and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.