CVE-2024-46750

What it actually does

Missing pci_dev_lock on the upstream bridge in pci_bus_lock allows unlocked secondary bus resets during pci_reset_bus calls, enabling concurrent access that triggers warnings and potential instability in PCI device reset paths.

Why it matters to the business

Systems running affected Linux kernels may experience instability or crashes during PCI bus resets on hardware using drivers like VMD, increasing operational risk until patched; prevalence in kernel ecosystems amplifies exposure for server and embedded deployments.

How an attack unfolds

An attacker with local access or through kernel-triggered paths (such as device probe) invokes pci_reset_bus which calls into pci_bus_reset without locking the bridge itself, allowing race conditions on secondary bus operations; no widespread remote exploitation observed despite mentions of zero-day campaigns.

How to fix it

Update to Linux kernel commit 0790b89c7e911003b8c50ae50e3ac7645de1fae9 or later stable releases containing the pci_dev_lock addition in pci_bus_lock; apply vendor kernel updates promptly.

How to confirm the fix worked

Confirm kernel source contains the pci_dev_lock call for bus->self inside pci_bus_lock and verify absence of the lockdep warning during pci_reset_bus operations on affected hardware.

Typical attack path

1. Gain local execution or trigger kernel PCI probe/reset paths
2. Invoke pci_reset_bus or equivalent reset function on a device behind a bridge
3. pci_bus_lock is called but omits lock on bus->self
4. Concurrent reset or access occurs leading to unlocked secondary bus reset
5. Kernel logs warning and potential device or system instability

How to detect it

Review kernel logs for warnings referencing pci_bridge_secondary_bus_reset or unlocked bus resets during device probe or reset; check for call traces involving pci_reset_bus and vmd_probe.

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all Linux distributions
• Monitor for PCI reset-related warnings in dmesg on production systems
• Test updates in staging environments before broad deployment due to low but present availability impact