CVE-2024-26605

What it actually does

Recursive acquisition of pci_bus_sem during ASPM power state changes on Qualcomm PCIe controllers causes a deadlock when the semaphore is already held by pci_walk_bus during asynchronous probe.

Why it matters to the business

Systems using affected Qualcomm PCIe hardware may experience boot hangs or kernel deadlocks, resulting in unplanned downtime and requiring manual intervention or reboots until kernels are updated.

How an attack unfolds

An attacker with local access widens the race window during asynchronous PCIe probe on vulnerable kernels; concurrent threads acquire the bus semaphore in pci_walk_bus then attempt re-acquisition inside pcie_aspm_pm_state_change, triggering the deadlock reported by lockdep.

How to fix it

Upgrade the Linux kernel to version 6.1.88 or later, or apply the commit 0f7908a016c092cfdaa16d785fa5099d867bc1a3. Reboot after installation. For distributions without the fix, apply vendor backports or disable ASPM on affected controllers as a temporary mitigation.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release; confirm absence of the recursive locking warning in dmesg during PCIe probe; test on hardware such as Lenovo ThinkPad X13s with artificial delays to ensure the race window no longer triggers deadlock.

Typical attack path

1. Trigger asynchronous probe of Qualcomm PCIe controller
2. Acquire pci_bus_sem via pci_walk_bus
3. Invoke qcom_pcie_host_post_init that calls qcom_pcie_enable_aspm
4. Call pci_set_power_state which attempts second read lock on the same semaphore
5. Deadlock occurs

How to detect it

Review dmesg and kernel logs for the exact lockdep warning mentioning recursive locking on pci_bus_sem during pcie_aspm_pm_state_change or qcom_pcie_enable_aspm calls; inspect boot logs for hangs coinciding with Qualcomm PCIe initialization on affected hardware.

What your security team should do

• Prioritize kernel updates on all systems containing Qualcomm PCIe controllers within the next patch cycle
• Monitor vendor advisories for backported fixes in LTS branches
• Add kernel version checks to configuration management and vulnerability scanning tools
• Document hardware models known to be affected for targeted testing