{
  "cveId": "CVE-2026-45904",
  "url": "https://patchblox.com/security/cve/CVE-2026-45904",
  "summary": "CVE-2026-45904 is fixed in 17 products on 1 platform, first by DEBIAN-CVE-2026-45904, released May 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  powerpc/eeh: fix recursive pci_lock_rescan_remov...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling  The recent commit 1010b4c012b0 (\u0022powerpc/eeh: Make EEH driver device hotplug safe\u0022) restructured the EEH driver to improve synchronization with the PCI hotplug layer.  However, it inadvertently moved pci_lock_rescan_remove() outside its intended scope in eeh_handle_normal_event(), leading to broken PCI error reporting and improper EEH event triggering. Specifically, eeh_handle_normal_event() acquired pci_lock_rescan_remove() before calling eeh_pe_bus_get(), but eeh_pe_bus_get() itself attempts to acquire the same lock internally, causing nested locking and disrupting normal EEH event handling paths.  This patch adds a boolean parameter do_lock to _eeh_pe_bus_get(), with two public wrappers:     eeh_pe_bus_get() with locking enabled.     eeh_pe_bus_get_nolock() that skips locking.  Callers that already hold pci_lock_rescan_remove() now use eeh_pe_bus_get_nolock() to avoid recursive lock acquisition.  Additionally, pci_lock_rescan_remove() calls are restored to the correct position\u2014after eeh_pe_bus_get() and immediately before iterating affected PEs and devices. This ensures EEH-triggered PCI removes occur under proper bus rescan locking without recursive lock contention.  The eeh_pe_loc_get() function has been split into two functions:     eeh_pe_loc_get(struct eeh_pe *pe) which retrieves the loc for given PE.     eeh_pe_loc_get_bus(struct pci_bus *bus) which retrieves the location     code for given bus.  This resolves lockdep warnings such as: \u003Csnip\u003E [   84.964298] [    T928] ============================================ [   84.964304] [    T928] WARNING: possible recursive locking detected [   84.964311] [    T928] 6.18.0-rc3 #51 Not tainted [   84.964315] [    T928] -------------------------------------------- [   84.964320] [    T928] eehd/928 is trying to acquire lock: [   84.964324] [    T928] c000000003b29d58 (pci_rescan_remove_lock){\u002B.\u002B.}-{3:3}, at: pci_lock_rescan_remove\u002B0x28/0x40 [   84.964342] [    T928]                        but task is already holding lock: [   84.964347] [    T928] c000000003b29d58 (pci_rescan_remove_lock){\u002B.\u002B.}-{3:3}, at: pci_lock_rescan_remove\u002B0x28/0x40 [   84.964357] [    T928]                        other info that might help us debug this: [   84.964363] [    T928]  Possible unsafe locking scenario:  [   84.964367] [    T928]        CPU0 [   84.964370] [    T928]        ---- [   84.964373] [    T928]   lock(pci_rescan_remove_lock); [   84.964378] [    T928]   lock(pci_rescan_remove_lock); [   84.964383] [    T928]                        *** DEADLOCK ***  [   84.964388] [    T928]  May be due to missing lock nesting notation  [   84.964393] [    T928] 1 lock held by eehd/928: [   84.964397] [    T928]  #0: c000000003b29d58 (pci_rescan_remove_lock){\u002B.\u002B.}-{3:3}, at: pci_lock_rescan_remove\u002B0x28/0x40 [   84.964408] [    T928]                        stack backtrace: [   84.964414] [    T928] CPU: 2 UID: 0 PID: 928 Comm: eehd Not tainted 6.18.0-rc3 #51 VOLUNTARY [   84.964417] [    T928] Hardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_022) hv:phyp pSeries [   84.964419] [    T928] Call Trace: [   84.964420] [    T928] [c0000011a7157990] [c000000001705de4] dump_stack_lvl\u002B0xc8/0x130 (unreliable) [   84.964424] [    T928] [c0000011a71579d0] [c0000000002f66e0] print_deadlock_bug\u002B0x430/0x440 [   84.964428] [    T928] [c0000011a7157a70] [c0000000002fd0c0] __lock_acquire\u002B0x1530/0x2d80 [   84.964431] [    T928] [c0000011a7157ba0] [c0000000002fea54] lock_acquire\u002B0x144/0x410 [   84.964433] [    T928] [c0000011a7157cb0] [c0000011a7157cb0] __mutex_lock\u002B0xf4/0x1050 [   84.964436] [    T928] [c0000011a7157e00] [c000000000de21d8] pci_lock_rescan_remove\u002B0x28/0x40 [   84.964439] [    T928] [c0000011a7157e20] [c00000000004ed98] eeh_pe_bus_get\u002B0x48/0xc0 [   84.964442] [    T928] [c0000011a7157e50] [c00000 ---truncated---",
  "published": "2026-05-27T14:17:04Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.0016,
  "epssPercentile": 0.05255,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dtb-aarch64",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.130.1",
      "fix": "SUSE-SU-2026:3602-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3602-1",
      "released": "2026-10-02T15:40:54Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23237-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23237-1",
      "released": "2026-08-11T21:34:22Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1.160000.2.19",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.130.1.150600.12.60.3",
      "fix": "SUSE-SU-2026:3602-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3602-1",
      "released": "2026-10-02T15:40:54Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1.150700.17.43.2",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1.160000.2.19",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.130.1",
      "fix": "SUSE-SU-2026:3602-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3602-1",
      "released": "2026-10-02T15:40:54Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-kvmsmall",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-kvmsmall",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP6_Update_30",
      "release": "sles 15.6",
      "fixedVersion": "1-150600.13.5.1",
      "fix": "SUSE-SU-2026:3602-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3602-1",
      "released": "2026-10-02T15:40:54Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7-RT_Update_19",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.1.5.1",
      "fix": "SUSE-SU-2026:3810-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3810-1",
      "released": "2026-08-26T10:47:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7_Update_20",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.15.3.2",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.130.1",
      "fix": "SUSE-SU-2026:3602-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3602-1",
      "released": "2026-10-02T15:40:54Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-qa",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-qa",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-rt",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.130.1",
      "fix": "SUSE-SU-2026:3602-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3602-1",
      "released": "2026-10-02T15:40:54Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.130.1",
      "fix": "SUSE-SU-2026:3602-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3602-1",
      "released": "2026-10-02T15:40:54Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "OPENSUSE-SU-2026:21555-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1",
      "released": "2026-08-12T01:09:28Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.78.1",
      "fix": "SUSE-SU-2026:3790-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3790-1",
      "released": "2026-08-25T12:24:44Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 16.0",
      "fixedVersion": "6.12.0-160000.37.1",
      "fix": "SUSE-SU-2026:23231-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1",
      "released": "2026-08-11T21:26:34Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.170-1",
      "fix": "DEBIAN-CVE-2026-45904",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-45904",
      "released": "2026-05-27T17:38:13Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.85-1",
      "fix": "DEBIAN-CVE-2026-45904",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-45904",
      "released": "2026-05-27T17:38:13Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.14-1",
      "fix": "DEBIAN-CVE-2026-45904",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-45904",
      "released": "2026-05-27T17:38:13Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}