CVE-2026-93822

A flaw was found in the Linux kernel's Broadcom iProc PCIe controller driver. The driver fails to acquire the appropriate lock when stopping and removing a root bus. A local user with administrative privileges could exploit this race condition by initiating simultaneous PCI rescan or hotplug operations through the sysfs interface. This flaw may result in a use-after-free condition, leading to a system crash and Denial of Service (DoS).

A Moderate-impact flaw was found in the Linux kernel's Broadcom iProc PCIe controller driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9, and the Red Hat Enterprise Linux CoreOS kernels shipped with OpenShift 4 and OpenShift 5. The driver stopped and removed a PCI root bus without holding the pci_rescan_remove_lock, so a local user with the privileges required to trigger PCI rescan or hotplug operations through the sysfs interface could race a concurrent rescan or hotplug request against root bus removal. Winning this race causes a use-after-free that crashes the kernel, resulting in a denial of service. The flaw affects only system availability; there is no impact on confidentiality or integrity, consistent with the Red Hat Moderate severity rating (CVSS 3.1 score of 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Red Hat Enterprise Linux 6, 7, and 10, and the RHIVOS 2 releases, are not affected; the recorded justifications for these streams indicate that the vulnerable code is not present in those kernels.

Fixes for the affected Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and OpenShift 4 and 5 releases are currently deferred. Exploitation requires local privileged access to the sysfs PCI interface, depends on winning a race with a root bus removal operation, and results only in a system crash rather than privilege escalation or data compromise, so the issue is assessed as Moderate and the fix is being delivered through the regular update process rather than an urgent out-of-cycle update. The residual risk until a fix is released is that a local privileged user could crash, and therefore deny service to, an affected system that uses the Broadcom iProc PCIe controller driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.