CVE-2024-26918

What it actually does

Incorrect requirement for RPM_ACTIVE state during PME polling combined with insufficient bridge power state enforcement allows config space to become inaccessible for subordinate devices when bridges enter low-power states such as D3hot.

Why it matters to the business

Linux systems using Thunderbolt or USB4 connections may lose visibility to attached endpoints such as NVMe storage after power state transitions, resulting in hardware functionality loss and potential data access disruption until the kernel is updated.

How an attack unfolds

The regression manifests during normal kernel PME polling when a parent bridge transitions to D3hot; the polled device's config space becomes inaccessible, causing device scan failures downstream of the bridge.

How to fix it

Update the Linux kernel to a version containing commit 63b1a3d9dd3b3f6d67f524e76270e66767090583 or later stable releases that include the fix; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Confirm the presence of commit 63b1a3d9dd3b3f6d67f524e76270e66767090583 in the kernel source tree; after update, verify successful device enumeration and PME handling for Thunderbolt/USB4 hierarchies under varying power states.

Typical attack path

1. Trigger runtime power management transition on a PCI bridge to D3hot
2. Kernel initiates PME polling on subordinate Thunderbolt/USB4 device
3. Config space access fails during pci_pme_wakeup
4. Device enumeration or wakeup for attached endpoints such as NVMe fails

How to detect it

Review kernel logs for PME polling errors, pci_pme_wakeup failures, or Thunderbolt/USB4 hierarchy scan issues; correlate with device attachment events and power state transitions.

What your security team should do

• Prioritize kernel update on all affected systems within standard maintenance windows
• Test Thunderbolt/USB4 device attachment and power state transitions post-update
• Monitor kernel changelogs for related power management fixes in subsequent releases