CVE-2026-74331 (GCVE-0-2026-74331)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:17
VLAI
Title
firmware_loader: Fix recursive lock in device_cache_fw_images()
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix recursive lock in device_cache_fw_images() A recursive locking deadlock can occur in the firmware loader's power management notification handler. During system suspend or hibernation preparation, fw_pm_notify() calls device_cache_fw_images(). This function acquires fw_lock to set the firmware cache state to FW_LOADER_START_CACHE and then iterates over all devices using dpm_for_each_dev() while still holding the lock. For each device, dev_cache_fw_image() schedules asynchronous work to cache the firmware. If memory allocation for the async work entry fails (e.g., in out-of-memory conditions), async_schedule_node_domain() falls back to executing the work function synchronously in the current thread. The synchronous execution path (__async_dev_cache_fw_image() -> cache_firmware() -> request_firmware() -> assign_fw()) attempts to acquire fw_lock again. Since the current thread already holds fw_lock, this results in a recursive locking deadlock. Fix this by releasing fw_lock immediately after updating the cache state and before calling dpm_for_each_dev(). The lock is only needed to protect the state update. Concurrent firmware requests will correctly see the FW_LOADER_START_CACHE state and use the piggyback mechanism, which is independently protected by its own fwc->name_lock.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < 806cb8fabfde7f830da5ae87777d52fdf50c4774 (git)
Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < 7865a1bfd20d10c03b083a5fc392d907ca5099b3 (git)
Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < 490b0385e4cfac691f7b18dde821c13e77b4770b (git)
Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < 38149b57427c736c08d9aa4c7b87deacd53e9e63 (git)
Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < a5b2a68a391b05d54552f13548a72a46c65006f7 (git)
Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < f25d6e4ec4c257030592bd671f113cf9584c52f0 (git)
Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < c0f2dedd41fe14dbe076c1672214802fb42cd8c8 (git)
Affected: ac39b3ea73aacde876d1d5ee1ca3e2719f771482 , < d3ec78f8f8d48a04a9fac38d47275c34645e5103 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "806cb8fabfde7f830da5ae87777d52fdf50c4774",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            },
            {
              "lessThan": "7865a1bfd20d10c03b083a5fc392d907ca5099b3",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            },
            {
              "lessThan": "490b0385e4cfac691f7b18dde821c13e77b4770b",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            },
            {
              "lessThan": "38149b57427c736c08d9aa4c7b87deacd53e9e63",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            },
            {
              "lessThan": "a5b2a68a391b05d54552f13548a72a46c65006f7",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            },
            {
              "lessThan": "f25d6e4ec4c257030592bd671f113cf9584c52f0",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            },
            {
              "lessThan": "c0f2dedd41fe14dbe076c1672214802fb42cd8c8",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            },
            {
              "lessThan": "d3ec78f8f8d48a04a9fac38d47275c34645e5103",
              "status": "affected",
              "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Fix recursive lock in device_cache_fw_images()\n\nA recursive locking deadlock can occur in the firmware loader\u0027s power\nmanagement notification handler.\n\nDuring system suspend or hibernation preparation, fw_pm_notify() calls\ndevice_cache_fw_images(). This function acquires fw_lock to set the\nfirmware cache state to FW_LOADER_START_CACHE and then iterates over all\ndevices using dpm_for_each_dev() while still holding the lock.\n\nFor each device, dev_cache_fw_image() schedules asynchronous work to cache\nthe firmware. If memory allocation for the async work entry fails (e.g., in\nout-of-memory conditions), async_schedule_node_domain() falls back to\nexecuting the work function synchronously in the current thread.\n\nThe synchronous execution path (__async_dev_cache_fw_image() -\u003e\ncache_firmware() -\u003e request_firmware() -\u003e assign_fw()) attempts to acquire\nfw_lock again. Since the current thread already holds fw_lock, this results\nin a recursive locking deadlock.\n\nFix this by releasing fw_lock immediately after updating the cache state\nand before calling dpm_for_each_dev(). The lock is only needed to protect\nthe state update. Concurrent firmware requests will correctly see the\nFW_LOADER_START_CACHE state and use the piggyback mechanism, which is\nindependently protected by its own fwc-\u003ename_lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:17:22.413Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/806cb8fabfde7f830da5ae87777d52fdf50c4774"
        },
        {
          "url": "https://git.kernel.org/stable/c/7865a1bfd20d10c03b083a5fc392d907ca5099b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/490b0385e4cfac691f7b18dde821c13e77b4770b"
        },
        {
          "url": "https://git.kernel.org/stable/c/38149b57427c736c08d9aa4c7b87deacd53e9e63"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5b2a68a391b05d54552f13548a72a46c65006f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f25d6e4ec4c257030592bd671f113cf9584c52f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0f2dedd41fe14dbe076c1672214802fb42cd8c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ec78f8f8d48a04a9fac38d47275c34645e5103"
        }
      ],
      "title": "firmware_loader: Fix recursive lock in device_cache_fw_images()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74331",
    "datePublished": "2026-08-15T05:58:24.420Z",
    "dateReserved": "2026-08-15T05:44:03.885Z",
    "dateUpdated": "2026-08-17T05:17:22.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74331",
      "date": "2026-09-21",
      "epss": "0.0019",
      "percentile": "0.08919"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/base/firmware_loader/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "806cb8fabfde7f830da5ae87777d52fdf50c4774",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7865a1bfd20d10c03b083a5fc392d907ca5099b3",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "490b0385e4cfac691f7b18dde821c13e77b4770b",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "38149b57427c736c08d9aa4c7b87deacd53e9e63",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a5b2a68a391b05d54552f13548a72a46c65006f7",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f25d6e4ec4c257030592bd671f113cf9584c52f0",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c0f2dedd41fe14dbe076c1672214802fb42cd8c8",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3ec78f8f8d48a04a9fac38d47275c34645e5103",
                    "status": "affected",
                    "version": "ac39b3ea73aacde876d1d5ee1ca3e2719f771482",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/base/firmware_loader/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.7"
                  },
                  {
                    "lessThan": "3.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Fix recursive lock in device_cache_fw_images()\n\nA recursive locking deadlock can occur in the firmware loader\u0027s power\nmanagement notification handler.\n\nDuring system suspend or hibernation preparation, fw_pm_notify() calls\ndevice_cache_fw_images(). This function acquires fw_lock to set the\nfirmware cache state to FW_LOADER_START_CACHE and then iterates over all\ndevices using dpm_for_each_dev() while still holding the lock.\n\nFor each device, dev_cache_fw_image() schedules asynchronous work to cache\nthe firmware. If memory allocation for the async work entry fails (e.g., in\nout-of-memory conditions), async_schedule_node_domain() falls back to\nexecuting the work function synchronously in the current thread.\n\nThe synchronous execution path (__async_dev_cache_fw_image() -\u003e\ncache_firmware() -\u003e request_firmware() -\u003e assign_fw()) attempts to acquire\nfw_lock again. Since the current thread already holds fw_lock, this results\nin a recursive locking deadlock.\n\nFix this by releasing fw_lock immediately after updating the cache state\nand before calling dpm_for_each_dev(). The lock is only needed to protect\nthe state update. Concurrent firmware requests will correctly see the\nFW_LOADER_START_CACHE state and use the piggyback mechanism, which is\nindependently protected by its own fwc-\u003ename_lock."
          }
        ],
        "id": "CVE-2026-74331",
        "lastModified": "2026-08-17T06:19:27.560",
        "metrics": {},
        "published": "2026-08-15T06:22:33.907",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/38149b57427c736c08d9aa4c7b87deacd53e9e63"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/490b0385e4cfac691f7b18dde821c13e77b4770b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7865a1bfd20d10c03b083a5fc392d907ca5099b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/806cb8fabfde7f830da5ae87777d52fdf50c4774"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a5b2a68a391b05d54552f13548a72a46c65006f7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c0f2dedd41fe14dbe076c1672214802fb42cd8c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d3ec78f8f8d48a04a9fac38d47275c34645e5103"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f25d6e4ec4c257030592bd671f113cf9584c52f0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-20T18:20:38+00:00",
      "cve": "CVE-2026-74331",
      "id": "CVE-2026-74331",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware_loader: Fix recursive lock in device_cache_fw_images()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74331.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:03:17Z",
      "cve": "CVE-2026-74331",
      "id": "CVE-2026-74331",
      "initial_release_date": "2026-08-27T16:51:58Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74331",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74331.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.