CVE-2026-97948

A flaw was found in the Linux kernel's PowerPC Enhanced Error Handling (EEH) subsystem. A recursive locking issue occurs during device reset handling when an error recovery process attempts to acquire a lock it already holds. When an error is detected on an affected device, this condition causes the error handling service to deadlock, resulting in a denial of service (DoS).

A low impact denial of service flaw was found in the Linux kernel's PowerPC Enhanced Error Handling (EEH) subsystem. When an EEH event is handled for an error detected directly on a PHB, or for a device whose driver returns PCI_ERS_RESULT_NEED_RESET without defining EEH-sensitive error handlers (such as slot_reset() or resume()), eeh_rmv_device() attempts to re-acquire the pci_rescan_remove_lock that eeh_handle_normal_event() already holds. This recursive locking deadlocks the eehd kernel thread and blocks PCI error recovery, resulting in a local denial of service. Triggering the flaw requires local access to a PowerPC system with EEH support and a specific PCI error recovery path, and it affects only availability, with no impact to confidentiality or integrity. Although the Red Hat CVSS:3.1 base score for this flaw is 5.5 (Moderate), Red Hat Product Security rates its impact as Low because of these restrictive preconditions and the availability-only consequence. The vulnerable code is present only in recent Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.22 and later kernel builds; earlier Red Hat Enterprise Linux 6, 7, and 8 releases and their kernel-rt builds, as well as earlier OpenShift Container Platform RHCOS releases, do not contain the vulnerable code and are therefore not affected. The fix for the affected streams is currently deferred to a future update; the residual risk until then is a potential hang of PCI error recovery on affected PowerPC systems when the specific error conditions occur.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.