Deadlock Vulnerability in Linux Kernel's PCI Hotplug Management
Summary
DEBIAN-CVE-2025-37843: In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Avoid unnecessary device replacement check Hot-removal of nested PCI hotplug ports suffers from a long-standing race condition which can le... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all software applications, ensuring efficient communication between hardware and software. The kernel's PCI subsystem manages Peripheral Component Interconnect devices, including hotplug ports that allow for dynamic addition and removal of hardware components. This vulnerability specifically affects the hot-removal process of nested PCI hotplug ports, leading to potential system deadlocks.
Vulnerability Detail
In the Linux kernel, a race condition exists during the hot-removal of nested PCI hotplug ports, which can lead to a deadlock situation. When a parent hotplug port acquires the pci_lock_rescan_remove() lock, it waits for the child hotplug port to unbind. However, if the child hotplug port attempts to acquire the same lock to remove its own children, a deadlock occurs. This issue is exacerbated by a recent commit that increased the frequency of deadlocks during device removal, particularly when multiple Thunderbolt devices are removed during system sleep. The vulnerability is complex and requires an intrusive fix.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid the deadlock by ensuring that the hotplug port itself is not hot-removed while attempting to remove its child devices. This can be done by managing the timing of device removals carefully.
Conclusion
The deadlock vulnerability in the Linux kernel's PCI hotplug management poses significant risks to system stability. Users are advised to update their Linux packages to the latest patched version to mitigate these risks. Additionally, careful management of device removals can serve as a temporary workaround.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition that can lead to a deadlock during the hot-removal of nested PCI hotplug ports in the Linux kernel.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability can cause system deadlocks, leading to unresponsive behavior and requiring a system reboot to recover.
Yes, a permanent fix is available in the patched version of the Linux package (6.12.25-1). Users should update to this version to mitigate the vulnerability.
Detailed information about the vulnerability can be found in the Debian CVE database and through community discussions on platforms like the Linux kernel mailing list.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
