CVE-2026-93098 (GCVE-0-2026-93098)
Vulnerability from cvelistv5
Published
2026-09-17 16:11
Modified
2026-10-19 09:05
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely. The deadlock manifests with the following call chain: [<0>] device_del+0x44/0x414  <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered: - Driver detach path: the driver core already tears down the rpmsg device. - Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached. Remove the redundant unregistration to fix the deadlock.
References
Impacted products
Vendor Product Version
Linux Linux Version: 93b6b9e4acff4794e7426d3ad64ef14e3b3e8919
Version: 24fd02c3a4798de7dc94b55d36a1685fe6cdaf69
Version: 32fe8cdf541863239b81c80b8b04112d6e8792cf
Version: c6210714347f72bae8e7142dc0a7f99923c466e7
Version: fcab5c2672f8dac3d77013dbe047b2441f4141f5
Version: f80e4e91b010ee7d6c52f24d069975ac955ac6b2
Version: a53e356df548f6b0e82529ef3cc6070f42622189
Version: a53e356df548f6b0e82529ef3cc6070f42622189
Version: 5.10.248   ≤
Version: 5.15.198   ≤
Version: 6.1.160   ≤
Version: 6.6.120   ≤
Version: 6.12.64   ≤
Version: 6.18.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/qcom_glink_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "73092c2292aa65515671e54abbcda2166d3827ed",
              "status": "affected",
              "version": "93b6b9e4acff4794e7426d3ad64ef14e3b3e8919",
              "versionType": "git"
            },
            {
              "lessThan": "bbc236357876d35a624030e5c50eedbc380be98e",
              "status": "affected",
              "version": "24fd02c3a4798de7dc94b55d36a1685fe6cdaf69",
              "versionType": "git"
            },
            {
              "lessThan": "8597f669a5268e0dcf243e2b2d6ca00370117057",
              "status": "affected",
              "version": "32fe8cdf541863239b81c80b8b04112d6e8792cf",
              "versionType": "git"
            },
            {
              "lessThan": "48f55b90f0d713e477e26b85d7327d9592d016f9",
              "status": "affected",
              "version": "c6210714347f72bae8e7142dc0a7f99923c466e7",
              "versionType": "git"
            },
            {
              "lessThan": "cbcdf96e1c87bc07055d04264018ded1f3bafffb",
              "status": "affected",
              "version": "fcab5c2672f8dac3d77013dbe047b2441f4141f5",
              "versionType": "git"
            },
            {
              "lessThan": "ecad679e2b92c419cc22cc8f257cd457d5192647",
              "status": "affected",
              "version": "f80e4e91b010ee7d6c52f24d069975ac955ac6b2",
              "versionType": "git"
            },
            {
              "lessThan": "e559626bee8a6632aafc08eedcdb4bf26ca245c5",
              "status": "affected",
              "version": "a53e356df548f6b0e82529ef3cc6070f42622189",
              "versionType": "git"
            },
            {
              "lessThan": "5a5a48e788e02fd8a8eb7188ce440572d6c12418",
              "status": "affected",
              "version": "a53e356df548f6b0e82529ef3cc6070f42622189",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.52",
              "status": "affected",
              "version": "6.18.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/rpmsg/qcom_glink_native.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15.198",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.160",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.120",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.12.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.18.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: glink: fix deadlock in endpoint destroy during driver detach\n\nDuring driver detach, the device core holds the device mutex throughout\nthe driver\u0027s remove callback chain.  When the rpmsg endpoint is\ndestroyed as part of that teardown, the GLINK endpoint destroy\nimplementation attempts to unregister the underlying rpmsg device.\nThat unregistration calls device_del(), which tries to re-acquire the\nsame device mutex already held higher up the stack, causing rmmod to\nhang indefinitely.\n\nThe deadlock manifests with the following call chain:\n\n[\u003c0\u003e] device_del+0x44/0x414\u2003\u2003\u003c- tries to acquire same mutex\n[\u003c0\u003e] device_unregister+0x18/0x34\n[\u003c0\u003e] rpmsg_unregister_device+0x28/0x4c\n[\u003c0\u003e] qcom_glink_remove_rpmsg_device+0x70/0xc0\n[\u003c0\u003e] qcom_glink_destroy_ept+0x58/0xbc\n[\u003c0\u003e] rpmsg_dev_remove+0x50/0x60\n[\u003c0\u003e] device_remove+0x4c/0x80\n[\u003c0\u003e] device_release_driver_internal+0x1cc/0x228  \u003c- acquires device mutex\n[\u003c0\u003e] driver_detach+0x4c/0x98\n[\u003c0\u003e] bus_remove_driver+0x6c/0xbc\n[\u003c0\u003e] driver_unregister+0x30/0x60\n[\u003c0\u003e] unregister_rpmsg_driver+0x10/0x1c\n[\u003c0\u003e] fastrpc_exit+0x28/0x38 [fastrpc]\n[\u003c0\u003e] __arm64_sys_delete_module+0x1b8/0x294\n[\u003c0\u003e] invoke_syscall+0x48/0x10c\n[\u003c0\u003e] el0_svc_common.constprop.0+0xc0/0xe0\n[\u003c0\u003e] do_el0_svc+0x1c/0x28\n[\u003c0\u003e] el0_svc+0x34/0x108\n[\u003c0\u003e] el0t_64_sync_handler+0xa0/0xe4\n[\u003c0\u003e] el0t_64_sync+0x198/0x19c\n\nThe rpmsg device unregistration inside endpoint destroy is redundant.\nIn both contexts where endpoint destruction is triggered:\n\n- Driver detach path: the driver core already tears down the rpmsg\n  device.\n\n- Channel close path: the rpmsg device is already unregistered before\n  endpoint destruction is reached.\n\nRemove the redundant unregistration to fix the deadlock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:05:31.403Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/73092c2292aa65515671e54abbcda2166d3827ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbc236357876d35a624030e5c50eedbc380be98e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8597f669a5268e0dcf243e2b2d6ca00370117057"
        },
        {
          "url": "https://git.kernel.org/stable/c/48f55b90f0d713e477e26b85d7327d9592d016f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbcdf96e1c87bc07055d04264018ded1f3bafffb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecad679e2b92c419cc22cc8f257cd457d5192647"
        },
        {
          "url": "https://git.kernel.org/stable/c/e559626bee8a6632aafc08eedcdb4bf26ca245c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a5a48e788e02fd8a8eb7188ce440572d6c12418"
        }
      ],
      "title": "rpmsg: glink: fix deadlock in endpoint destroy during driver detach",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93098",
    "datePublished": "2026-09-17T16:11:11.703Z",
    "dateReserved": "2026-09-17T16:02:15.084Z",
    "dateUpdated": "2026-10-19T09:05:31.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.