PCI State Management Vulnerability in Linux Kernel - Affects Debian Packages
Summary
DEBIAN-CVE-2024-26918: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix active state requirement in PME polling The commit noted in fixes added a bogus requirement that runtime PM managed devices need to be in the R... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It plays a critical role in system performance and stability. This vulnerability impacts the PCI (Peripheral Component Interconnect) subsystem, specifically related to power management states, which can affect devices connected through Thunderbolt and USB4 interfaces.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the PCI subsystem regarding the active state requirement for PME (Power Management Event) polling. A recent commit introduced a faulty requirement that runtime PM (Power Management) managed devices must be in the RPM_ACTIVE state for PME polling to occur. This is incorrect, as devices in low power states should be polled instead. The issue arises when the device configuration space becomes inaccessible during the wake-up process, particularly when the parent bridge is in a low power state, leading to potential failures in device detection and functionality.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for updates and apply the patch as soon as it becomes available.
Conclusion
The PCI state management vulnerability in the Linux kernel poses a significant risk to device functionality within Debian systems. Users are encouraged to update to the patched version 6.7.7-1 to mitigate this issue. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves incorrect power management state requirements for PCI devices, which can lead to device detection failures.
The vulnerability affects Debian packages of the Linux kernel prior to version 6.7.7-1.
You can use Vulert to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability may prevent the system from properly detecting connected devices, leading to reduced functionality or system instability.
While the primary concern is device detection, any instability caused by the vulnerability could potentially lead to data loss if critical devices become inaccessible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
