Cloudanix VulnDB

CVE-2026-93098

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can make the system freeze forever when certain drivers are removed, forcing a reboot instead of a clean shutdown of the driver.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Deadlock during rpmsg GLINK endpoint destruction on driver detach: device core holds device mutex while rpmsg endpoint destroy path calls device_unregister which attempts to reacquire the same mutex, causing indefinite hang on module unload.

Why it matters to the business

Unloading affected kernel modules hangs the system indefinitely, preventing clean driver removal, module updates, or service restarts and requiring a reboot to recover.

How an attack unfolds

An attacker with local root privileges triggers module unload (rmmod or equivalent) for a driver using rpmsg GLINK endpoints; the detach path acquires the device mutex then the endpoint destroy attempts redundant device unregistration, deadlocking the thread and hanging the unload operation.

How to fix it

Update to a kernel containing the upstream fix that removes the redundant rpmsg device unregistration inside qcom_glink_destroy_ept. Rebuild and deploy the patched kernel; test module unload paths after update.

How to confirm the fix worked

Confirm the fix is present by inspecting the rpmsg glink source for removal of the rpmsg_unregister_device call inside endpoint destroy; attempt module unload in a test environment and verify it completes without hanging.

Typical attack path

  1. Obtain local root or sufficient privileges to unload kernel modules
  2. Identify and trigger unload of an rpmsg GLINK-using driver (e.g., fastrpc)
  3. Driver detach acquires device mutex and walks remove callbacks
  4. Endpoint destroy calls device_unregister which blocks on the held mutex
  5. Unload hangs indefinitely; system requires hard reset to recover

How to detect it

Look for hung task warnings or traces showing device_del blocked inside driver_detach or rpmsg_dev_remove during module unload; examine dmesg and kernel logs for the deadlock call chain involving qcom_glink_destroy_ept and device_unregister.

What your security team should do

  • Prioritize patching production kernels that include rpmsg GLINK drivers
  • Add module unload tests to CI and kernel update validation procedures
  • Monitor for hung tasks or stuck rmmod processes as operational indicators

The record

In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely. The deadlock manifests with the following call chain: [<0>] device_del+0x44/0x414  <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered: - Driver detach path: the driver core already tears down the rpmsg device. - Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached. Remove the redundant unregistration to fix the deadlock.

Affected packages

Ecosystem Package Introduced Fixed