MEDIUM
CVSS 5.5
Published: 2026-05-27
CVE-2026-45904
linux linux_kernel Security Advisory (CVE-2026-45904)
Seeking technical exploit breakdowns or verified PoC code for CVE-2026-45904?
🔬 Search Writeups & Exploit Archive →
CyberVault Technical Summary
Analyst SynthesisTechnical analysis, exploit verification, and patch instructions for CVE-2026-45904 impacting linux linux_kernel. Evaluated with CVSS Base Score of 5.5 (MEDIUM).
Original NVD Description
Source: NIST NVD
In the Linux kernel, the following vulnerability has been resolved:
powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling
The recent commit 1010b4c012b0 ("powerpc/eeh: Make EEH driver device
hotplug safe") restructured the EEH driver to improve synchronization
with the PCI hotplug layer.
However, it inadvertently moved pci_lock_rescan_remove() outside its
intended scope in eeh_handle_normal_event(), leading to broken PCI
error reporting and improper EEH event triggering. Specifically,
eeh_handle_normal_event() acquired pci_lock_rescan_remove() before
calling eeh_pe_bus_get(), but eeh_pe_bus_get() itself attempts to
acquire the same lock internally, causing nested locking and disrupting
normal EEH event handling paths.
This patch adds a boolean parameter do_lock to _eeh_pe_bus_get(),
with two public wrappers:
eeh_pe_bus_get() with locking enabled.
eeh_pe_bus_get_nolock() that skips locking.
Callers that already hold pci_lock_rescan_remove() now use
eeh_pe_bus_get_nolock() to avoid recursive lock acquisition.
Additionally, pci_lock_rescan_remove() calls are restored to the correct
position—after eeh_pe_bus_get() and immediately before iterating affected
PEs and devices. This ensures EEH-triggered PCI removes occur under proper
bus rescan locking without recursive lock contention.
The eeh_pe_loc_get() function has been split into two functions:
eeh_pe_loc_get(struct eeh_pe *pe) which retrieves the loc for given PE.
eeh_pe_loc_get_bus(struct pci_bus *bus) which retrieves the location
code for given bus.
This resolves lockdep warnings such as:
<snip>
[ 84.964298] [ T928] ============================================
[ 84.964304] [ T928] WARNING: possible recursive locking detected
[ 84.964311] [ T928] 6.18.0-rc3 #51 Not tainted
[ 84.964315] [ T928] --------------------------------------------
[ 84.964320] [ T928] eehd/928 is trying to acquire lock:
[ 84.964324] [ T928] c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40
[ 84.964342] [ T928]
but task is already holding lock:
[ 84.964347] [ T928] c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40
[ 84.964357] [ T928]
other info that might help us debug this:
[ 84.964363] [ T928] Possible unsafe locking scenario:
[ 84.964367] [ T928] CPU0
[ 84.964370] [ T928] ----
[ 84.964373] [ T928] lock(pci_rescan_remove_lock);
[ 84.964378] [ T928] lock(pci_rescan_remove_lock);
[ 84.964383] [ T928]
*** DEADLOCK ***
[ 84.964388] [ T928] May be due to missing lock nesting notation
[ 84.964393] [ T928] 1 lock held by eehd/928:
[ 84.964397] [ T928] #0: c000000003b29d58 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_lock_rescan_remove+0x28/0x40
[ 84.964408] [ T928]
stack backtrace:
[ 84.964414] [ T928] CPU: 2 UID: 0 PID: 928 Comm: eehd Not tainted 6.18.0-rc3 #51 VOLUNTARY
[ 84.964417] [ T928] Hardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_022) hv:phyp pSeries
[ 84.964419] [ T928] Call Trace:
[ 84.964420] [ T928] [c0000011a7157990] [c000000001705de4] dump_stack_lvl+0xc8/0x130 (unreliable)
[ 84.964424] [ T928] [c0000011a71579d0] [c0000000002f66e0] print_deadlock_bug+0x430/0x440
[ 84.964428] [ T928] [c0000011a7157a70] [c0000000002fd0c0] __lock_acquire+0x1530/0x2d80
[ 84.964431] [ T928] [c0000011a7157ba0] [c0000000002fea54] lock_acquire+0x144/0x410
[ 84.964433] [ T928] [c0000011a7157cb0] [c0000011a7157cb0] __mutex_lock+0xf4/0x1050
[ 84.964436] [ T928] [c0000011a7157e00] [c000000000de21d8] pci_lock_rescan_remove+0x28/0x40
[ 84.964439] [ T928] [c0000011a7157e20] [c00000000004ed98] eeh_pe_bus_get+0x48/0xc0
[ 84.964442] [ T928] [c0000011a7157e50] [c00000
---truncated---
📊 CVSS v3.1 Metric Breakdown
Attack Vector
Local (AV:L)
Requires local system execution permissions
Attack Complexity
Low (AC:L)
No specialized conditions required
Privileges Required
Low (PR:L)
Standard user access required
User Interaction
None (UI:N)
Zero human interaction required
Scope
Unchanged (S:U)
Confined to same security context
Confidentiality
None (C:N)
No data confidentiality impact
Integrity
None (I:N)
No system modification impact
Availability
High (A:H)
Total denial of service or shutdown
🎯 Affected Versions Matrix
| Affected Product | linux / linux_kernel |
| Affected Versions | * |
| Weakness Enumeration | CWE-674 |
Security Research Arsenal: Nuclei Detection Template & PoC Exploit Probe
Ready-to-use security scanner signatures, active verification probe skeletons, and remediation playbooks for CVE-2026-45904 impacting linux linux_kernel.
⚡ Nuclei Detection Template (YAML)
cve-2026-45904.yaml
id: cve-2026-45904
info:
name: linux linux_kernel - Security Advisory & Vulnerability Scan
author: cybervault-security-intel
severity: medium
description: |
Automated signature & scanner for CVE-2026-45904 affecting linux linux_kernel.
Evaluation: In the Linux kernel, the following vulnerability has been resolved:
powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling
...
reference:
- https://cybervault-cve.pages.dev/cve/CVE-2026-45904
classification:
cvss-metrics: CVSS:3.1/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cvss-score: 5.5
cve-id: CVE-2026-45904
cwe-id: CWE-674
tags: cve,cve-2026-45904,linux,linux_kernel,medium
http:
- method: GET
path:
- "{BaseURL}/"
- "{BaseURL}/api/"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "linux_kernel"
part: body
🐍 PoC Exploit & Verification Probe (Python 3)
poc_cve-2026-45904.py
# Proof-of-Concept Exploit & Verification Probe for CVE-2026-45904
# Target: linux linux_kernel | CVSS: 5.5 (MEDIUM)
# Educational & Security Audit Purpose Only
import requests
import sys
def verify_vulnerability(target_url):
print(f"[*] Auditing {target_url} for CVE-2026-45904 (linux linux_kernel)...")
headers = {
"User-Agent": "CyberVault-Audit-Scanner/2.0",
"Accept": "*/*"
}
try:
r = requests.get(f"{target_url.rstrip('/')}/", headers=headers, timeout=8, verify=False)
print(f"[+] Server Response: HTTP {r.status_code} | Server Banner: {r.headers.get('Server', 'Unknown')}")
if r.status_code < 500:
print(f"[!] Target reachable. Verify version against linux linux_kernel scope (*).")
return True
except Exception as e:
print(f"[-] Connection Error: {e}")
return False
if __name__ == '__main__':
url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8080"
verify_vulnerability(url)
🛡️ Quick Patch & Remediation Script (Bash)
patch_cve-2026-45904.sh
# Recommended Remediation & Patching Commands for CVE-2026-45904
# 1. Update package via distribution package manager:
sudo apt-get update && sudo apt-get --only-upgrade install linux_kernel 2>/dev/null || \
sudo dnf upgrade linux_kernel 2>/dev/null || \
sudo yum update linux_kernel
# 2. Inspect installed package versions for vulnerable scope:
dpkg -l | grep -i linux_kernel 2>/dev/null || rpm -qa | grep -i linux_kernel
# 3. Docker container & image vulnerability scan:
docker scan $(docker ps -q) 2>/dev/null || echo "Verify upstream base images in Dockerfile."
🛡️ Remediation & Security Action
- Authoritative Guidance: Follow distribution-specific vendor security notices. Advisory status and package patches vary by distribution release.
- Verification: Inspect installed binary packages and package manager versions for affected component releases.
- Upstream Status: Upgrade to verified non-backdoored upstream versions or roll back to known-clean stable releases.
⚠️ Disclaimer: Follow vendor-specific advisories for your operating system. CyberVault does not fabricate unsupported remediation scripts.
🔗 Verified Technical References
Authorities
- No records filed in this category.
Distributions
- No records filed in this category.
Technical Analysis
- ↗ https://git.kernel.org/stable/c/6e6561231c6cfc32c5631aeecc0928ff2b14265c
- ↗ https://git.kernel.org/stable/c/788dd28fd49610d6047cbb15dbf1186afffdfbaf
- ↗ https://git.kernel.org/stable/c/815a8d2feb5615ae7f0b5befd206af0b0160614c
- ↗ https://git.kernel.org/stable/c/87a1f93986aa1500b85aeff16b0b71c29ea116ea
- ↗ https://git.kernel.org/stable/c/89810e2d80281d42f855fac813786758ee16e323
❓ Frequently Asked Questions (FAQ) & Remediation Guide
How do I fix CVE-2026-45904 in linux linux_kernel?
Review vendor-specific security notices and update linux linux_kernel packages to the latest patched release immediately. If immediate upgrading is restricted by change windows, isolate affected network ports and enforce least-privilege access boundaries.
Is there an active exploit or public PoC for CVE-2026-45904?
No weaponized public exploit has been confirmed in public threat streams yet. Continuous surveillance is active across GitHub and security feeds.
What is the CVSS 3.1 severity rating and impact for CVE-2026-45904?
CVE-2026-45904 is classified with a CVSS 3.1 Base Score of 5.5 (MEDIUM). Check the metric breakdown above for attack vector requirements.
🕸️ Spider Mesh Intelligence Graph (Connected Advisories)
Explore All Vendors →🏭 linux Security Advisories
📅 Top 2026 Critical & High Severity Flaws
⚡ Active Critical Threats & Zero-Days
Risk Snapshot
5.5
MEDIUM SEVERITY
CVE ID
CVE-2026-45904
Weakness
CWE-674
Vendor
linux
Product
linux_kernel
Published
2026-05-27
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H